Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'drm-fixes-2025-09-26' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"Weekly fixes, some fbcon font handling fixes, then amdgpu/xe/i915 with
a few, and a few misc fixes for other drivers. Seems about right for
this stage, and I don't know of anything outstanding.
fbcon:
- fix OOB access in font allocation
- fix integer overflow in font handling
amdgpu:
- Backlight fix
- DC preblend fix
- DCN 3.5 fix
- Cleanup output_tf_change
xe:
- Don't expose sysfs attributes not applicable for VFs
- Fix build with CONFIG_MODULES=n
- Don't copy pinned kernel bos twice on suspend
i915:
- Set O_LARGEFILE in __create_shmem()
- Guard reg_val against a INVALID_TRANSCODER [ddi]
ast:
- sleeps causing cpu stall fix
panthor:
- scheduler race condition fix
gma500:
- NULL ptr deref in hdmi teardown fix"
* tag 'drm-fixes-2025-09-26' of https://gitlab.freedesktop.org/drm/kernel:
drm/panthor: Defer scheduler entitiy destruction to queue release
drm/amd/display: remove output_tf_change flag
drm/amd/display: Init DCN35 clocks from pre-os HW values
drm/amd/display: Use mpc.preblend flag to indicate preblend
drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume
fbcon: Fix OOB access in font allocation
drm/i915/ddi: Guard reg_val against a INVALID_TRANSCODER
drm/i915: set O_LARGEFILE in __create_shmem()
drm/xe: Don't copy pinned kernel bos twice on suspend
drm/xe: Fix build with CONFIG_MODULES=n
drm/xe/vf: Don't expose sysfs attributes not applicable for VFs
fbcon: fix integer overflow in fbcon_do_set_font
drm/gma500: Fix null dereference in hdmi teardown
drm/ast: Use msleep instead of mdelay for edid read
+167
-35
+8
-4
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+8
-4
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
···
2037
2037
2038
2038
dc_hardware_init(adev->dm.dc);
2039
2039
2040
+
adev->dm.restore_backlight = true;
2041
+
2040
2042
adev->dm.hpd_rx_offload_wq = hpd_rx_irq_create_workqueue(adev);
2041
2043
if (!adev->dm.hpd_rx_offload_wq) {
2042
2044
drm_err(adev_to_drm(adev), "failed to create hpd rx offload workqueue.\n");
···
3401
3399
dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D0);
3402
3400
3403
3401
dc_resume(dm->dc);
3402
+
adev->dm.restore_backlight = true;
3404
3403
3405
3404
amdgpu_dm_irq_resume_early(adev);
3406
3405
···
9832
9829
bool mode_set_reset_required = false;
9833
9830
u32 i;
9834
9831
struct dc_commit_streams_params params = {dc_state->streams, dc_state->stream_count};
9835
-
bool set_backlight_level = false;
9836
9832
9837
9833
/* Disable writeback */
9838
9834
for_each_old_connector_in_state(state, connector, old_con_state, i) {
···
9951
9949
acrtc->hw_mode = new_crtc_state->mode;
9952
9950
crtc->hwmode = new_crtc_state->mode;
9953
9951
mode_set_reset_required = true;
9954
-
set_backlight_level = true;
9955
9952
} else if (modereset_required(new_crtc_state)) {
9956
9953
drm_dbg_atomic(dev,
9957
9954
"Atomic commit: RESET. crtc id %d:[%p]\n",
···
10007
10006
* to fix a flicker issue.
10008
10007
* It will cause the dm->actual_brightness is not the current panel brightness
10009
10008
* level. (the dm->brightness is the correct panel level)
10010
-
* So we set the backlight level with dm->brightness value after set mode
10009
+
* So we set the backlight level with dm->brightness value after initial
10010
+
* set mode. Use restore_backlight flag to avoid setting backlight level
10011
+
* for every subsequent mode set.
10011
10012
*/
10012
-
if (set_backlight_level) {
10013
+
if (dm->restore_backlight) {
10013
10014
for (i = 0; i < dm->num_of_edps; i++) {
10014
10015
if (dm->backlight_dev[i])
10015
10016
amdgpu_dm_backlight_set_level(dm, i, dm->brightness[i]);
10016
10017
}
10018
+
dm->restore_backlight = false;
10017
10019
}
10018
10020
}
10019
10021
+7
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+7
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
···
611
611
u32 actual_brightness[AMDGPU_DM_MAX_NUM_EDP];
612
612
613
613
/**
614
+
* @restore_backlight:
615
+
*
616
+
* Flag to indicate whether to restore backlight after modeset.
617
+
*/
618
+
bool restore_backlight;
619
+
620
+
/**
614
621
* @aux_hpd_discon_quirk:
615
622
*
616
623
* quirk for hpd discon while aux is on-going.
+1
-1
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
+1
-1
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
···
821
821
struct dm_plane_state *dm_plane_state = to_dm_plane_state(plane_state);
822
822
const struct drm_color_lut *shaper = NULL, *lut3d = NULL;
823
823
uint32_t exp_size, size, dim_size = MAX_COLOR_3DLUT_SIZE;
824
-
bool has_3dlut = adev->dm.dc->caps.color.dpp.hw_3d_lut;
824
+
bool has_3dlut = adev->dm.dc->caps.color.dpp.hw_3d_lut || adev->dm.dc->caps.color.mpc.preblend;
825
825
826
826
/* shaper LUT is only available if 3D LUT color caps */
827
827
exp_size = has_3dlut ? MAX_COLOR_LUT_ENTRIES : 0;
+1
-1
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+1
-1
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
···
1633
1633
drm_object_attach_property(&plane->base,
1634
1634
dm->adev->mode_info.plane_ctm_property, 0);
1635
1635
1636
-
if (dpp_color_caps.hw_3d_lut) {
1636
+
if (dpp_color_caps.hw_3d_lut || dm->dc->caps.color.mpc.preblend) {
1637
1637
drm_object_attach_property(&plane->base,
1638
1638
mode_info.plane_shaper_lut_property, 0);
1639
1639
drm_object_attach_property(&plane->base,
+119
-2
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
+119
-2
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
···
587
587
return true;
588
588
}
589
589
590
-
static void dcn35_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
590
+
static void dcn35_save_clk_registers_internal(struct dcn35_clk_internal *internal, struct clk_mgr *clk_mgr_base)
591
+
{
592
+
struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base);
593
+
594
+
// read dtbclk
595
+
internal->CLK1_CLK4_CURRENT_CNT = REG_READ(CLK1_CLK4_CURRENT_CNT);
596
+
internal->CLK1_CLK4_BYPASS_CNTL = REG_READ(CLK1_CLK4_BYPASS_CNTL);
597
+
598
+
// read dcfclk
599
+
internal->CLK1_CLK3_CURRENT_CNT = REG_READ(CLK1_CLK3_CURRENT_CNT);
600
+
internal->CLK1_CLK3_BYPASS_CNTL = REG_READ(CLK1_CLK3_BYPASS_CNTL);
601
+
602
+
// read dcf deep sleep divider
603
+
internal->CLK1_CLK3_DS_CNTL = REG_READ(CLK1_CLK3_DS_CNTL);
604
+
internal->CLK1_CLK3_ALLOW_DS = REG_READ(CLK1_CLK3_ALLOW_DS);
605
+
606
+
// read dppclk
607
+
internal->CLK1_CLK1_CURRENT_CNT = REG_READ(CLK1_CLK1_CURRENT_CNT);
608
+
internal->CLK1_CLK1_BYPASS_CNTL = REG_READ(CLK1_CLK1_BYPASS_CNTL);
609
+
610
+
// read dprefclk
611
+
internal->CLK1_CLK2_CURRENT_CNT = REG_READ(CLK1_CLK2_CURRENT_CNT);
612
+
internal->CLK1_CLK2_BYPASS_CNTL = REG_READ(CLK1_CLK2_BYPASS_CNTL);
613
+
614
+
// read dispclk
615
+
internal->CLK1_CLK0_CURRENT_CNT = REG_READ(CLK1_CLK0_CURRENT_CNT);
616
+
internal->CLK1_CLK0_BYPASS_CNTL = REG_READ(CLK1_CLK0_BYPASS_CNTL);
617
+
}
618
+
619
+
static void dcn35_save_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
591
620
struct clk_mgr_dcn35 *clk_mgr)
592
621
{
622
+
struct dcn35_clk_internal internal = {0};
623
+
char *bypass_clks[5] = {"0x0 DFS", "0x1 REFCLK", "0x2 ERROR", "0x3 400 FCH", "0x4 600 FCH"};
624
+
625
+
dcn35_save_clk_registers_internal(&internal, &clk_mgr->base.base);
626
+
627
+
regs_and_bypass->dcfclk = internal.CLK1_CLK3_CURRENT_CNT / 10;
628
+
regs_and_bypass->dcf_deep_sleep_divider = internal.CLK1_CLK3_DS_CNTL / 10;
629
+
regs_and_bypass->dcf_deep_sleep_allow = internal.CLK1_CLK3_ALLOW_DS;
630
+
regs_and_bypass->dprefclk = internal.CLK1_CLK2_CURRENT_CNT / 10;
631
+
regs_and_bypass->dispclk = internal.CLK1_CLK0_CURRENT_CNT / 10;
632
+
regs_and_bypass->dppclk = internal.CLK1_CLK1_CURRENT_CNT / 10;
633
+
regs_and_bypass->dtbclk = internal.CLK1_CLK4_CURRENT_CNT / 10;
634
+
635
+
regs_and_bypass->dppclk_bypass = internal.CLK1_CLK1_BYPASS_CNTL & 0x0007;
636
+
if (regs_and_bypass->dppclk_bypass < 0 || regs_and_bypass->dppclk_bypass > 4)
637
+
regs_and_bypass->dppclk_bypass = 0;
638
+
regs_and_bypass->dcfclk_bypass = internal.CLK1_CLK3_BYPASS_CNTL & 0x0007;
639
+
if (regs_and_bypass->dcfclk_bypass < 0 || regs_and_bypass->dcfclk_bypass > 4)
640
+
regs_and_bypass->dcfclk_bypass = 0;
641
+
regs_and_bypass->dispclk_bypass = internal.CLK1_CLK0_BYPASS_CNTL & 0x0007;
642
+
if (regs_and_bypass->dispclk_bypass < 0 || regs_and_bypass->dispclk_bypass > 4)
643
+
regs_and_bypass->dispclk_bypass = 0;
644
+
regs_and_bypass->dprefclk_bypass = internal.CLK1_CLK2_BYPASS_CNTL & 0x0007;
645
+
if (regs_and_bypass->dprefclk_bypass < 0 || regs_and_bypass->dprefclk_bypass > 4)
646
+
regs_and_bypass->dprefclk_bypass = 0;
647
+
648
+
if (clk_mgr->base.base.ctx->dc->debug.pstate_enabled) {
649
+
DC_LOG_SMU("clk_type,clk_value,deepsleep_cntl,deepsleep_allow,bypass\n");
650
+
651
+
DC_LOG_SMU("dcfclk,%d,%d,%d,%s\n",
652
+
regs_and_bypass->dcfclk,
653
+
regs_and_bypass->dcf_deep_sleep_divider,
654
+
regs_and_bypass->dcf_deep_sleep_allow,
655
+
bypass_clks[(int) regs_and_bypass->dcfclk_bypass]);
656
+
657
+
DC_LOG_SMU("dprefclk,%d,N/A,N/A,%s\n",
658
+
regs_and_bypass->dprefclk,
659
+
bypass_clks[(int) regs_and_bypass->dprefclk_bypass]);
660
+
661
+
DC_LOG_SMU("dispclk,%d,N/A,N/A,%s\n",
662
+
regs_and_bypass->dispclk,
663
+
bypass_clks[(int) regs_and_bypass->dispclk_bypass]);
664
+
665
+
// REGISTER VALUES
666
+
DC_LOG_SMU("reg_name,value,clk_type");
667
+
668
+
DC_LOG_SMU("CLK1_CLK3_CURRENT_CNT,%d,dcfclk",
669
+
internal.CLK1_CLK3_CURRENT_CNT);
670
+
671
+
DC_LOG_SMU("CLK1_CLK4_CURRENT_CNT,%d,dtbclk",
672
+
internal.CLK1_CLK4_CURRENT_CNT);
673
+
674
+
DC_LOG_SMU("CLK1_CLK3_DS_CNTL,%d,dcf_deep_sleep_divider",
675
+
internal.CLK1_CLK3_DS_CNTL);
676
+
677
+
DC_LOG_SMU("CLK1_CLK3_ALLOW_DS,%d,dcf_deep_sleep_allow",
678
+
internal.CLK1_CLK3_ALLOW_DS);
679
+
680
+
DC_LOG_SMU("CLK1_CLK2_CURRENT_CNT,%d,dprefclk",
681
+
internal.CLK1_CLK2_CURRENT_CNT);
682
+
683
+
DC_LOG_SMU("CLK1_CLK0_CURRENT_CNT,%d,dispclk",
684
+
internal.CLK1_CLK0_CURRENT_CNT);
685
+
686
+
DC_LOG_SMU("CLK1_CLK1_CURRENT_CNT,%d,dppclk",
687
+
internal.CLK1_CLK1_CURRENT_CNT);
688
+
689
+
DC_LOG_SMU("CLK1_CLK3_BYPASS_CNTL,%d,dcfclk_bypass",
690
+
internal.CLK1_CLK3_BYPASS_CNTL);
691
+
692
+
DC_LOG_SMU("CLK1_CLK2_BYPASS_CNTL,%d,dprefclk_bypass",
693
+
internal.CLK1_CLK2_BYPASS_CNTL);
694
+
695
+
DC_LOG_SMU("CLK1_CLK0_BYPASS_CNTL,%d,dispclk_bypass",
696
+
internal.CLK1_CLK0_BYPASS_CNTL);
697
+
698
+
DC_LOG_SMU("CLK1_CLK1_BYPASS_CNTL,%d,dppclk_bypass",
699
+
internal.CLK1_CLK1_BYPASS_CNTL);
700
+
701
+
}
593
702
}
594
703
595
704
static bool dcn35_is_spll_ssc_enabled(struct clk_mgr *clk_mgr_base)
···
732
623
void dcn35_init_clocks(struct clk_mgr *clk_mgr)
733
624
{
734
625
struct clk_mgr_internal *clk_mgr_int = TO_CLK_MGR_INTERNAL(clk_mgr);
626
+
struct clk_mgr_dcn35 *clk_mgr_dcn35 = TO_CLK_MGR_DCN35(clk_mgr_int);
735
627
736
628
init_clk_states(clk_mgr);
737
629
···
743
633
else
744
634
clk_mgr->dp_dto_source_clock_in_khz = clk_mgr->dprefclk_khz;
745
635
636
+
dcn35_save_clk_registers(&clk_mgr->boot_snapshot, clk_mgr_dcn35);
637
+
638
+
clk_mgr->clks.ref_dtbclk_khz = clk_mgr->boot_snapshot.dtbclk * 10;
639
+
if (clk_mgr->boot_snapshot.dtbclk > 59000) {
640
+
/*dtbclk enabled based on */
641
+
clk_mgr->clks.dtbclk_en = true;
642
+
}
746
643
}
747
644
static struct clk_bw_params dcn35_bw_params = {
748
645
.vram_type = Ddr4MemType,
···
1440
1323
dcn35_bw_params.wm_table = ddr5_wm_table;
1441
1324
}
1442
1325
/* Saved clocks configured at boot for debug purposes */
1443
-
dcn35_dump_clk_registers(&clk_mgr->base.base.boot_snapshot, clk_mgr);
1326
+
dcn35_save_clk_registers(&clk_mgr->base.base.boot_snapshot, clk_mgr);
1444
1327
1445
1328
clk_mgr->base.base.dprefclk_khz = dcn35_smu_get_dprefclk(&clk_mgr->base);
1446
1329
clk_mgr->base.base.clks.ref_dtbclk_khz = 600000;
-1
drivers/gpu/drm/amd/display/dc/dc.h
-1
drivers/gpu/drm/amd/display/dc/dc.h
+2
-4
drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+2
-4
drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
···
1982
1982
* updating on slave planes
1983
1983
*/
1984
1984
if (pipe_ctx->update_flags.bits.enable ||
1985
-
pipe_ctx->update_flags.bits.plane_changed ||
1986
-
pipe_ctx->stream->update_flags.bits.out_tf ||
1987
-
(pipe_ctx->plane_state &&
1988
-
pipe_ctx->plane_state->update_flags.bits.output_tf_change))
1985
+
pipe_ctx->update_flags.bits.plane_changed ||
1986
+
pipe_ctx->stream->update_flags.bits.out_tf)
1989
1987
hws->funcs.set_output_transfer_func(dc, pipe_ctx, pipe_ctx->stream);
1990
1988
1991
1989
/* If the pipe has been enabled or has a different opp, we
+2
-4
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+2
-4
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
···
2019
2019
* updating on slave planes
2020
2020
*/
2021
2021
if (pipe_ctx->update_flags.bits.enable ||
2022
-
pipe_ctx->update_flags.bits.plane_changed ||
2023
-
pipe_ctx->stream->update_flags.bits.out_tf ||
2024
-
(pipe_ctx->plane_state &&
2025
-
pipe_ctx->plane_state->update_flags.bits.output_tf_change))
2022
+
pipe_ctx->update_flags.bits.plane_changed ||
2023
+
pipe_ctx->stream->update_flags.bits.out_tf)
2026
2024
hws->funcs.set_output_transfer_func(dc, pipe_ctx, pipe_ctx->stream);
2027
2025
2028
2026
/* If the pipe has been enabled or has a different opp, we
+1
-1
drivers/gpu/drm/ast/ast_dp.c
+1
-1
drivers/gpu/drm/ast/ast_dp.c
+1
-1
drivers/gpu/drm/gma500/oaktrail_hdmi.c
+1
-1
drivers/gpu/drm/gma500/oaktrail_hdmi.c
+3
-2
drivers/gpu/drm/i915/display/intel_ddi.c
+3
-2
drivers/gpu/drm/i915/display/intel_ddi.c
···
596
596
enum transcoder master;
597
597
598
598
master = crtc_state->mst_master_transcoder;
599
-
drm_WARN_ON(display->drm,
600
-
master == INVALID_TRANSCODER);
599
+
if (drm_WARN_ON(display->drm,
600
+
master == INVALID_TRANSCODER))
601
+
master = TRANSCODER_A;
601
602
temp |= TRANS_DDI_MST_TRANSPORT_SELECT(master);
602
603
}
603
604
} else {
+7
drivers/gpu/drm/i915/gem/i915_gem_shmem.c
+7
drivers/gpu/drm/i915/gem/i915_gem_shmem.c
···
514
514
if (IS_ERR(filp))
515
515
return PTR_ERR(filp);
516
516
517
+
/*
518
+
* Prevent -EFBIG by allowing large writes beyond MAX_NON_LFS on shmem
519
+
* objects by setting O_LARGEFILE.
520
+
*/
521
+
if (force_o_largefile())
522
+
filp->f_flags |= O_LARGEFILE;
523
+
517
524
obj->filp = filp;
518
525
return 0;
519
526
}
+1
-7
drivers/gpu/drm/panthor/panthor_sched.c
+1
-7
drivers/gpu/drm/panthor/panthor_sched.c
···
886
886
if (IS_ERR_OR_NULL(queue))
887
887
return;
888
888
889
-
if (queue->entity.fence_context)
890
-
drm_sched_entity_destroy(&queue->entity);
889
+
drm_sched_entity_destroy(&queue->entity);
891
890
892
891
if (queue->scheduler.ops)
893
892
drm_sched_fini(&queue->scheduler);
···
3556
3557
group = xa_erase(&gpool->xa, group_handle);
3557
3558
if (!group)
3558
3559
return -EINVAL;
3559
-
3560
-
for (u32 i = 0; i < group->queue_count; i++) {
3561
-
if (group->queues[i])
3562
-
drm_sched_entity_destroy(&group->queues[i]->entity);
3563
-
}
3564
3560
3565
3561
mutex_lock(&sched->reset.lock);
3566
3562
mutex_lock(&sched->lock);
+2
-2
drivers/gpu/drm/xe/xe_bo_evict.c
+2
-2
drivers/gpu/drm/xe/xe_bo_evict.c
···
158
158
if (ret)
159
159
return ret;
160
160
161
-
ret = xe_bo_apply_to_pinned(xe, &xe->pinned.late.kernel_bo_present,
162
-
&xe->pinned.late.evicted, xe_bo_evict_pinned);
161
+
ret = xe_bo_apply_to_pinned(xe, &xe->pinned.late.external,
162
+
&xe->pinned.late.external, xe_bo_evict_pinned);
163
163
164
164
if (!ret)
165
165
ret = xe_bo_apply_to_pinned(xe, &xe->pinned.late.kernel_bo_present,
+1
-1
drivers/gpu/drm/xe/xe_configfs.c
+1
-1
drivers/gpu/drm/xe/xe_configfs.c
+1
-1
drivers/gpu/drm/xe/xe_device_sysfs.c
+1
-1
drivers/gpu/drm/xe/xe_device_sysfs.c
+10
-3
drivers/video/fbdev/core/fbcon.c
+10
-3
drivers/video/fbdev/core/fbcon.c
···
2504
2504
unsigned charcount = font->charcount;
2505
2505
int w = font->width;
2506
2506
int h = font->height;
2507
-
int size;
2507
+
int size, alloc_size;
2508
2508
int i, csum;
2509
2509
u8 *new_data, *data = font->data;
2510
2510
int pitch = PITCH(font->width);
···
2531
2531
if (fbcon_invalid_charcount(info, charcount))
2532
2532
return -EINVAL;
2533
2533
2534
-
size = CALC_FONTSZ(h, pitch, charcount);
2534
+
/* Check for integer overflow in font size calculation */
2535
+
if (check_mul_overflow(h, pitch, &size) ||
2536
+
check_mul_overflow(size, charcount, &size))
2537
+
return -EINVAL;
2535
2538
2536
-
new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);
2539
+
/* Check for overflow in allocation size calculation */
2540
+
if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &alloc_size))
2541
+
return -EINVAL;
2542
+
2543
+
new_data = kmalloc(alloc_size, GFP_USER);
2537
2544
2538
2545
if (!new_data)
2539
2546
return -ENOMEM;