Pull drm fixes from Dave Airlie:
 "The final set of merge window fixes, from AMD mostly. with one set of
  panthor mmu fixes.

  amdgpu:
   - UALink fixes
   - Runtime PM fixes
   - GPUVM fixes
   - Mac fixes
   - HDMI fixes
   - DP MST fix
   - Userptr fix
   - SMU fixes
   - DSC fix
   - VCE/UVD sched teardown fix
   - Display runpm reference fix
   - Display TD-LUT fix
   - SMU 13.x fixes
   - SMU 14.x fixes
   - Gang submit fix
   - Passive DVI sink fix
   - USB4 tunnel fix
   - Freesync fix

  amdkfd:
   - SVM fixes
   - Fix doorbell allocation race
   - GC 12.1 fix
   - GPU reset fix
   - Buffer accounting fixes
   - Bounds checking fixes
   - Hotplug fixes
   - SVM fixes
   - CRIU fixes
   - GFX12 fix

  panthor:
   - Fix bugs in MMU handling"

* tag 'drm-next-2026-10-31' of https://gitlab.freedesktop.org/drm/kernel: (52 commits)
  drm/amd/display: refresh cached HDMI FreeSync state
  drm/amd/display: Cap DSC bpp for USB4 DP tunnels
  drm/amd/display: Poll passive DVI sinks for EDID readiness
  drm/amdgpu: re-enable GFXOFF for compute on GFX12
  drm/amdkfd: evict the queues only once for CRIU PROCESS_INFO
  drm/amdgpu: drop the gang leader reference when freeing gang jobs
  drm/amdkfd: send SMI process and VM fault events only to allowed clients
  drm/amdkfd: validate SRAT subtables before parsing
  drm/amd/pm: preserve committed OD features for SMU 14.0.2
  drm/amd/pm: add zero fan stop temperature support on smu 14.0.2
  drm/amd/pm: preserve committed OD features for SMU 13.0.0/13.0.7
  drm/amd/display: Initialize missing TD-LUT programming inputs
  drm/amdkfd: split vram_pages of SVM ranges prefetched without a GPU mapping
  drm/amdgpu: reject CS chunks too large for kvmalloc()
  drm/amd/display: take a runtime PM reference only when a CRTC turns on
  drm/amdgpu: guard VCE/UVD sched entity teardown on failed probe
  drm/amdkfd: stop restore retries on device unplug
  drm/amdkfd: tear down KFD processes before early fini_sw on disconnect
  drm/amdkfd: Validate the control stack of a restored queue
  drm/amdkfd: correct vram_available calculation
  ...

Pull x86 platform driver updates from Ilpo Järvinen:
 "The usual updates for laptop quirks from HP, ASUS, Acer, Dell etc:
   - new model names and recent CPU support
   - more special button / function key handling
   - battery and hardware monitoring quirks

  Tool updates to intel-speed-select

  WMI now supports non-x86 architectures

  Miscellaneous cleanups / refactoring / improvements"

* tag 'platform-drivers-x86-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (237 commits)
  platform/x86: asus-wmi: name the TUF keyboard RGB state and speed codes
  platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming
  platform/x86: asus-wmi: rename TUF RGB state DEVID to _CMD
  platform/x86: asus-armoury: add power limits quirk for GU605CM
  platform/x86: asus-armoury: add power limits quirk for G533QS
  platform/x86: asus-armoury: add power limits quirk for GA402NV
  platform/x86: asus-armoury: add power limits quirk for FA608UP
  platform/x86: asus-armoury: add power limits quirk for FA608UH
  platform/x86: asus-armoury: add power limits quirk for FA608PM
  platform/x86: asus-armoury: add power limits quirk for G713QR
  platform/x86: ibm_rtl: Fix potential OOB read at signature search
  platform/x86: acer-wmi: Add support for Acer Nitro AN16-41
  platform/x86: acer-wmi: Cycle platform profile on mode key 0x4
  platform/x86: hp-wmi: Disable hwmon attributes when no fans are usable
  platform/x86: gpd pocket fan: Cancel work before releasing GPIOs
  platform/x86: asus-armoury: Add XBOX ROG Ally X 20 Tunables
  platform/x86: msi-wmi: Ignore WMI events for keys also handled by atkbd
  platform/x86: msi-wmi: Sort scancodes numerically
  platform: arm64: Add a driver for the EC found on ASUS Glymur machines
  MAINTAINERS: Add myself as a LENOVO drivers co-maintainer
  ...

Commit 2affe2bbc997 ("drm/amdgpu: disable gfxoff with the compute
workload on gfx12") disabled GFXOFF whenever a user-mode compute queue
exists, as a workaround for an OpenCL test failure. The MES firmware
issue behind that failure has since been addressed, so the workaround
is no longer required.

Without this change, idle inference servers that hold a context for
hours never let the graphics block power down, costing roughly 3-4%
reported GPU activity and ~3 W per GPU at idle.

Measured on gfx1200 with an idle HIP process holding one stream and
two resident KFD queues:

  before:  VDDGFX 695 mV, GPU load 2%, ~9-10 W
  after:   VDDGFX  35 mV, GPU load 0%, ~8 W (idle baseline)

The resident queue count is unchanged in both cases; only GFXOFF
availability differs. The ocltst runtime suite (40 tests) passes with
and without this change.

Fixes: 2affe2bbc997 ("drm/amdgpu: disable gfxoff with the compute workload on gfx12")
Signed-off-by: Harkirat Gill <harkirat.gill@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit f6d97ecb68b8623da2f83997a9c8c57a1a9649f9)

Every job of a gang except the leader holds a reference to the
scheduled fence of the leader in job->gang_submit. Only
amdgpu_job_free(), used for jobs which never ran, drops it, so for every
gang submission which completes the scheduler fence of the leader, and
with it its hardware fence, is leaked. amdgpu_job_free() in turn checks
for the leader only after drm_sched_job_cleanup() cleared the scheduler
fence, so a leader freed there drops a reference it never took.

On navi31, 100 submissions of a GFX + COMPUTE gang grow the slab cache
drm_sched_fence is merged into by 60 to 180 objects each time, while
100 GFX only submissions don't.

Use amdgpu_job_free() for the jobs the scheduler frees too, and check
for the gang leader there before drm_sched_job_cleanup() clears the
scheduler fence. As the scheduler clears the entity of the jobs it
picked up, check for the scheduler fence instead to tell whether the job
needs cleaning up.

Keep freeing the remaining IBs with amdgpu_job_free_resources() after
drm_sched_job_cleanup(), so that it frees them with the hardware fence or
right away and not with the scheduler fence, which nobody signals for
jobs aborted after drm_sched_job_arm(), like a CS returning -EAGAIN.

v2: unify amdgpu_job_free() and amdgpu_job_free_cb() (Christian), don't
    free the remaining IBs with the scheduler fence
v3: drop the comments (Christian)
v4: free the IBs with amdgpu_job_free_resources() again (Christian)

Fixes: 68ce8b242242 ("drm/amdgpu: add gang submit backend v2")
Fixes: f7d66fb2ea43 ("drm/amdgpu: cleanup scheduler job initialization v2")
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit df4d6d404d44bbc8fc850bc7f9f136a25dabf180)
Cc: stable@vger.kernel.org

The CS ioctl copies every chunk with vmemdup_array_user() before it
looks at it, for whatever length_dw userspace gives. kvmalloc() warns
about allocations above INT_MAX when called without __GFP_NOWARN, so any
process with the render node can trigger a warning. On navi31, a CS with
a chunk of length_dw 0x20000000 returns -ENOMEM after:

  WARNING: mm/slub.c:6841 at __kvmalloc_node_noprof+0x5a5/0x7d0

Reject such chunks with -EINVAL before trying to copy them.

Fixes: 2098105ec65c ("drm: drop drm_[cm]alloc* helpers")
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit dab5f5280406088591645f499f048dcfefab8d7d)
Cc: stable@vger.kernel.org

Since commit 037b98a2312e ("drm/amdgpu: move UVD and VCE sched entity
init after sched init"), drm_sched_entity_init() for the VCE and UVD
kernel entities runs in the scheduler-init phase, well after the
IP-block sw_init phase has allocated the vcpu_bos.

If probe fails between the two phases, amdgpu_device_fini_sw() still
runs the per-IP sw_fini callbacks for blocks that did complete
sw_init. Both amdgpu_vce_sw_fini() and amdgpu_uvd_sw_fini() then call
drm_sched_entity_destroy() on an entity that was never initialized:
entity->rq is NULL and drm_sched_entity_flush() dereferences it,
oopsing in whatever context drove the failed probe.

The hole was latent-but-safe until commit 2df5efb45425 ("drm/sched:
Remove redundant entity->rq initialization and checks") removed the
if (!entity->rq) early return that commit 1decbf6bb0b4 ("drm/sched:
Fix entities with 0 rqs.") had put in drm_sched_entity_flush(), on the
grounds that entity->rq can never be NULL. That holds only for
entities that completed drm_sched_entity_init() — not for the
never-initialized entity this teardown path reaches.

Observed on real hardware: MI50 (Vega20, VCE 4.0 / UVD 7.2) behind a
Thunderbolt link — a pciehp presence/link-change event re-probes the
device; when the re-probe fails (-EINVAL here), the cleanup path
NULL-derefs inside drm_sched_entity_flush() in the pciehp IRQ thread
and takes the whole machine down (panic_on_oops, EFI pstore capture).
Reproduced twice on 7.3-rc5, 2026-10-06 and 2026-10-09, identical
signature; the faulting instruction is `mov (%rax),%r15` on rax =
entity->rq == NULL, i.e. `sched = entity->rq->sched`:

  BUG: kernel NULL pointer dereference
  RIP: drm_sched_entity_flush+0x34/0x2d0 [gpu_sched]
  drm_sched_entity_destroy
  amdgpu_vce_sw_fini
  vce_v4_0_sw_fini
  amdgpu_device_fini_sw
  ...
  pciehp_configure_device
  pciehp_handle_presence_or_link_change

Guard the entity teardown on entity->rq, which is set only by
drm_sched_entity_init(). amdgpu_ring_fini() already self-guards via
the rings[] registration, and the vcpu_bo/firmware cleanup still runs
as before.

v2: retarget Fixes: at commit 2df5efb45425 ("drm/sched: Remove
redundant entity->rq initialization and checks") — the !entity->rq
check from commit 1decbf6bb0b4 ("drm/sched: Fix entities with 0
rqs.") that Alex pointed to was removed by it in the 7.3 window,
so this is a regression there, not a pre-existing hole.

Fixes: 2df5efb45425 ("drm/sched: Remove redundant entity->rq initialization and checks")
Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 3ad55d18f468fa81be725301d1e138ecd5148e6a)
Cc: stable@vger.kernel.org

amdgpu_amdkfd_restore_userptr_worker() and svm_range_restore_work()
reschedule themselves when validation fails with evicted objects
pending. After a surprise removal the restore paths fail with -ENODEV
permanently, so rescheduling just spins the worker uselessly until
cancel_delayed_work_sync() in fini finally stops it - which can take
a while, since process teardown itself is delayed by the dead device.

Treat -ENODEV as terminal in both workers.

Cc: Xiaogang Chen <xiaogang.chen@amd.com>
Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 266fab83139600e58db7e900e930c722e619b78c)
Cc: stable@vger.kernel.org

On surprise removal, amdgpu_device_fini_hw() calls
amdgpu_amdkfd_device_fini_sw() when pci_dev_is_disconnected() is true.
fini_sw frees kfd.dev, but KFD processes may still be alive and hold
references to it: kfd_process_destroy() dereferences kfd.dev via
kfd_processes_remove(), and svm_range_list_fini() /
kfd_process_free_outstanding_kfd_bos() touch per-device SVM state.

The kfd_processes_count wait only happens later in
kgd2kfd_teardown_processes(), called from the top-half remove path
well after fini_sw. In the observed failure the killed KFD process
(SIGBUS on unplug) stuck in D state on its exit path, so
kfd_processes_count never drained and the PCIe removal thread wedged
permanently in cond_resched(), producing soft-lockup and hung-task
splats.

Tear KFD processes down before freeing kfd.dev on the disconnect
path, and guard kgd2kfd_teardown_processes() against kfd.dev already
being gone when it runs a second time.

Cc: Xiaogang Chen <xiaogang.chen@amd.com>
Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com>
Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 836f44ba87ed7b1d83e2b7bfc788f8c6437b03a7)
Cc: stable@vger.kernel.org

Pull drm updates from Dave Airlie:
 "Highlights:

   - core: a lot of atomic refactoring in progress, panic got split into
     a core/helpers model

   - amdgpu: enables HDMI 2.1 FRL and other good things finally, UAlink
     over Ethernet support

   - xe: has a bunch of CRI support, ras error for bad vram, memory
     offlining support.

   - msm: enables a bunch more GPUs.

  Otherwise it's a the usual mountain of stuff all over the place.
  Details:

  rust:
   - I/O tree shared with driver-core
   - DMA tree shared with driver-core
   - allow aux registration data closures to return covariant sub-fields
   - Implement Send and Sync for MapleTree
   - add pci resource flags and IORESOURCE_MEM_64

  drm/rust:
   - add dma_fence abstraction
   - init DRM registrations and their data in place
   - drop unused flags argument to registration

  vgaarb:
   - rework API to pass a private ptr instead of pci device

  sound:
   - adapt to omapdrm changes

  gem:
   - add callback for handle count going to 0

  gpusvm:
   - share one HMM fault and keep single mappings inline

  pagemap:
   - Prevent CPU stalls during unbounded pagemap teardown

  dma-fence:
   - fix docs

  vga_switcheroo:
   - disconnect from fbcon
   - update fbcon from within fbdev emulation

  atomic:
   - move DRM from state reset callbacks to atomic_create_state
   - remove drm_simple_encoder_init

  panic:
   - split into core and helpers

  buddy:
   - improve dirty tracking

  clients:
   - improve vmap handling
   - fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko

  display:
   - export HDMI SCDC status data via debugfs
   - rework SCDC for better HDMI 2.0 support
   - dp/mst: improve DPCD compliance

  edid:
   - parse AMD VSDB
   - parse ALLM/VRR capabilities
   - support detecting panel size

  log:
   - add drm_warn_ratelimited

  sched:
   - cleanup interface
   - add missing locking
   - fix run-queue cleanup
   - fix locking

  sysfb:
   - remove obsolete quirk for Lenovo D330
   - fix panel orientation for non-native display modes
   - drop drm_class_device_register

  colorop:
   - provide DRM_COLOR_OP_FIXED_MATRIX

  bridge:
   - analogix: Support eDP lane mapping
   - ti-sn65dsi83: Support LVDS Channel B on SN65DSI84
   - Select DRM_PANEL_BRIDGE for various drivers that require it
   - add chrontel ch7218a support

  panel:
   - panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001
   - samsung-s6d16d0: Use mipi_dsi_*_multi() functions
   - support Ilitek ILI7836A OLED plus DT bindings
   - support Novatek NT36532 plus DT bindings
   - convert several drivers to managed cleanup
   - fix Kconfig selections
   - edp:
      - Add support for BOE NV140FHM-T0A
      - Support CSOT MNE007QB1-1
      - NV140WU2-M70
   - ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization
   - samsung: Share test-key helpers
   - ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings
   - simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE
     DV215FHM-R01 plus DT bindings
   - Refactor struct drm_panel to contain struct drm_bridge plus fallout
     in various panel drivers
   - Add support for BOE Novatek NT51021, Retroid Pocket 6, Raydium
     RM69220 DDIC panels, Sharp LQ138P1JX61 eDP, BOE NV140FHD-N43, AUO
     B140HAN04.0, AUO 0x0db3, panels.

  amdgpu:
   - use AMD VSDB for freesync
   - implement YUV-to-RGB with fixed-matrix colorop
   - enable FRL for HDMI
   - HDMI 2.1 freesync support
   - HDMI 2.1 ALLM support
   - HDMI 2.1 VRR support
   - UALoE (UALink over Ethernet) support
   - add syncobj_points to userq signal ioctl
   - drop unused kunit tests
   - NBIO/GC/MMHUB/SMU updates/fixes
   - GPU spatial partitioning updates
   - display kunit fixes
   - userq fixes
   - RGB quantization fixes
   - DC RMCM refactor
   - DP MST fixes
   - USB4 fixes
   - add new trace events
   - Rework display instance handling
   - stack frame size fixes for various compilers/configs
   - VCN 4/5 reset fixes
   - freesync updates
   - cursor refactor
   - Fix direct scanout alpha on some DRM_FORMATs
   - Expand Mac reserved memory workaround
   - Make runtime pm more fine grained

  amdkfd:
   - updates and fixes
   - GC 10 CU occupancy support

  radeon:
   - eDP fix for DCE3.2 iMacs

  xe:
   - add drm_ras netlink error event support
   - add memory page offlining support
   - introduce error threshold to drm_ras
   - fix stale GTT mappings on unmap
   - reject page faults for non-page fault mode scratch VM
   - enable CRI package and VRAM temperatures
   - introduce cold reset recovery
   - handle CRI+ power interval encoding
   - VF migration for multi-queue
   - handle exec queue teardown after hot unplug
   - alerts and controller enabling modifications
   - use IBCv3 on PTL
   - VRAM health check
   - report GT TDR and VM rebind faults using SIGID
   - add multi_queue_active_lrca debugfs
   - shrinker: Runtime PM reference for non-system memory
   - guc: Add simple KLV decoder helpers
   - debugfs: Expose per-engine idle status
   - Keep walking on SVM eviction failure
   - Nuke PTs only after unlinking contested VMAs
   - limit sg segment size to PAGE_SIZE on Xen PV
   - keep VF LMEM bar size low if no VFs
   - CPU binds and ULLS on migration queue
   - New PTL PCI ID
   - Enable PXP for NVL-S
   - Do not dma_fence_put zero fences in err_out path
   - Refresh TTM LRU on SVM prefetch
   - export device UID in sysfs

  i915:
   - rename GEN6_PCODE_DATA to match spec
   - fix incorrect RCU teardown order
   - fix potential UAF in command parsing
   - avoid WARN splat during RPS boosting race
   - use simpler min functions
   - Fixes to make i915 work well with PREEMPT_RT

  i915/display:
   - Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path
   - Switch DG2 MPLL to DPLL framework
   - DP-HDMI PCON DSC fixes
   - limit invalid joiner combinations
   - CDCLK related fixes and refactor around PCODE integration
   - Gate UHBR SST SDP splitting on sink caps
   - add HDMI TMDS audio bandwidth check
   - vswing/preemph override
   - enable AS SDP Skip frames
   - Handle negative configuration index on DP link caps for robustness
   - Preparation for enabling SDR plane color pipeline
   - An eDP quirk for HP Pavilion Plus
   - Introduce PME (Power Management Event) support on display hotplug
   - Handle VSC SDP revision 7 in unpack

  msm:
   - CI:
      - Dropped sc7180 trogdor lazor from the CI
   - Core:
      - Fixed msm_ioremap for resources without a name
      - Changed msm.separate_gpu_kms to default to auto selection
   - GPU:
      - Enable CLX (Current Limit eXtension) for gen8 to avoid exceeding
        limits on CX/GX rails
      - New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi), x2-85
        (Mahua)
      - Fix VBIF halt mask on a306, which was preventing runpm suspend
      - Enable THP support for GEM buffers
      - Add modparam to disable waiting on fences in shrinker
      - Drop use of drm_prime_sg_to_page_array()
      - a5xx: don't read the GPMU registers on GPUs without a GPMU
      - a2xx/a3xx/a5xx: hangcheck progress detection
      - a6xx: gmuwrapper runpm fix
      - Calculate reported GMEM size based on active slices
      - Split a6xx/a7xx/a8xx catalog
   - DP:
      - Picked up some preparation patches for the MST support
      - Fixed reported status of the link training
   - DPU:
      - Fixed CRTC bandwidth computation
      - Fixed DSC programming
      - Fixed encoder disablement path
   - DSI:
      - Fixed VM leak in error path
      - Indention fix
   - MDP5:
      - Added MSM8952 configuration
      - Dropped incorrect cursor pipe on MSM8976/56
   - HDMI:
      - Small fixes

  nouveau:
   - improve runtime PM on R570 GSP firmware
   - various fixes throughout the driver
   - dispnv50: support 2.147 GHz pixel clock in GB20x

  nova:
   - add initial uapi concept
   - add initial PRAMIN access support
   - add GpuMm centralized memory manager
   - add GPU VM and BAR1 support
   - add GPU interrupts and GSP events support
   - GSP messaging fixes

  tyr:
   - use bitfield!
   - zero unsupported and newly added GPU info fields
   - limit doorbell array to 17 entries

  exynos:
   - FIMD fixes
      - Fix clock leak on resume error path
      - Fix Sparse warnings by adding missing __iomem annotation
   - VIDI cleanup
      - Replace kmalloc() and copy_from_user() with memdup_user()

  amdxdna:
   - fix BO handling
   - Support AIE2 rev 9
   - Fix UAF access in scheduler fences
   - Update workqueue interface
   - expose busy time via fdinfo

  ast:
   - support 256-byte EDID

  hyperv_drm:
   - remove support for pre win10 hosts

  komeda:
   - fix GLB_CORE_ID usage

  omap:
   - report HDMI hotplug events to ASoC HDMI codec

  panthor:
   - provide gpu_cache_flush tracepoint
   - improve dma_fence signalling latency
   - improve locking
   - export scheduling information via debugfs
   - Validate user-space input against firmware limits

  qaic:
   - reject BOs that exceed maximum page count
   - add missing include statements

  verisilicon:
   - fix hardware cursor offsets

  vkms:
   - implement YUV-to-RGB with fixed-matrix colorop

  gma500:
   - avoid unsupported ARGB formats in primary plane

  hibmc:
   - handle vblank interrupts correctly

  ivpu:
   - add DRM_IVPU_CAP_CMDQ_SET_PRIORITY
   - support command-queue priority ioctl
   - Simplify NULL-pointer handling in cleanup code

  arcpgu:
   - replace simple-display pipeline with regular atomic helpers

  aspeed:
   - replace simple-display pipeline with regular atomic helpers

  gm12u320:
   - replace simple-display pipeline with regular atomic helpers

  imagination:
   - various improvement to firmware interaction
   - add job to pvr_job_submit_fw trace event

  mali-dp:
   - fix runtime PM leak

  mcde:
   - replace simple-display pipeline with regular atomic helpers

  p111:
   - replace simple-display pipeline with regular atomic helpers
   - drop unsupported alpha formats from primary plane

  rcar-du:
   - support Renesas R-Car V4H DSC
   - dsi: Support larger transfers with AXI memory
   - Support RZ/G3L SoC

  repaper:
   - replace simple-display pipeline with regular atomic helpers

  rockchip:
   - dsi: improve PHY timings

  ssd130x:
   - support Solomon SSD1351 OLED plus DT bindings
   - ssd133x: upgrade color format to RGB565
   - ssd132x: Set correct hardware window when clearing screen

  tve200:
   - replace simple-display pipeline with regular atomic helpers

  xen:
   - replace simple-display pipeline with regular atomic helpers

  v3d:
   - improve job handling under perfmon

  vc4:
   - reliably reset V3D
   - drop brcm,vc4-v3d compatible

  virtio:
   - fix damage handling
   - Support ARGB8888 for virtio primary planes.

  host1x:
   - Support partitioning

  imx:
   - Replace simple-display with regular atomic helpers

  mxsfb:
   - Support bus formats plus DT bindings

  tegra:
   - improve syncobj handling on submit

  panfrost:
   - add Mali-G68 support
   - improve GPU reset handling

  rockchip:
   - add HDMI 2.0 support to dw-hdmi-qp
   - improve HPD handling"

* tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernel: (2324 commits)
  drm/adp: Switch to drm_atomic_helper_connector_create_state
  drm/malidp: Convert to atomic_create_state
  drm/vc4: Switch to drm_atomic_helper_connector_create_state
  drm/sysfb: Switch to drm_atomic_helper_connector_create_state
  drm/solomon: ssd130x: Switch to drm_atomic_helper_connector_create_state
  drm/imx: ipuv3: Switch to drm_atomic_helper_connector_create_state
  drm/hyperv: Switch to drm_atomic_helper_connector_create_state
  drm/bridge: megachips: Switch to drm_atomic_helper_connector_create_state
  drm/bridge: lontium-lt8912b: Switch to drm_atomic_helper_connector_create_state
  drm/arm: komeda: Switch to drm_atomic_helper_connector_create_state
  drm/appletbdrm: Fix incorrect error message on encoder attach failure
  drm/sun4i: hdmi: Convert to drmm_connector_hdmi_init()
  drm/rockchip: rk3066_hdmi: Advertise HDMI 1.4 capabilities
  drm/bridge: lontium-lt9611: Advertise HDMI 1.4 capabilities
  drm/bridge: ite-it66121: Advertise HDMI 1.2 capabilities
  drm/bridge: ite-it6263: Advertise HDMI 1.3 capabilities
  drm/bridge: ite-it6263: Drop redundant .mode_valid hook
  drm/bridge: inno-hdmi: Advertise HDMI 1.2 capabilities
  drm/bridge: adv7511: Advertise HDMI 1.2 capabilities
  drm/sched: Document entity->stopped is protected by entity->lock
  ...

Pull IOMMU updates from Joerg Roedel:
 "Core:
   - Detect scatterlist length overflows and finalize deferred domain
     attachments before mapping MSI pages
   - Consolidate x86 MSI reserved-region handling and clean up internal
     DMA and SVA helpers

  AMD IOMMU:
   - Add IOMMU PerfOpt support, enabled by amdgpu for supported
     integrated GPUs in identity domains
   - Restrict forced identity mapping to GPUs that require it
   - Fix kdump device-table allocation and reuse, ATS configuration
     error handling, and an interrupt-remapping allocation leak
   - Clean up device probing and initialization
   - Add Vasant Hegde as an AMD IOMMU maintainer

  ARM SMMUv2:
   - Device-tree binding updates for Qualcomm Maili and Nord SoCs

  ARM SMMUv3:
   - Work around hardware integration issue on Google Tensor G5 SoCs
     where all DMA transactions appear as instruction fetches
   - Allow command queue size to be configured on the kernel
     command-line
   - Reduce queue sizes when running as a kdump kernel
   - Fix some pre-existing issues in the driver and kunit tests reported
     by Sashiko
   - Fix handling of Arm hardware errata relating to the contiguous hint
     when using SVA
   - Rework the TLB invalidation logic in preparation for enabling
     iommu-pt in future
   - Minor cleanups in preparation for improving support for kdump

  Apple DART:
   - Support device-tree DMA aperture specifications

  Broadcom:
   - Add BCM2712 IOMMU support for Raspberry Pi 5 display and multimedia
     devices, including the generic page-table format and shared TLB
     cache management

  Hyper-V:
   - Add a para-virtualized guest IOMMU driver with guest-managed
     stage-1 page tables and page-selective IOTLB invalidation

  Intel VT-d:
   - Enhanced IQE fault handling for batched multiple descriptors,
   - Optimization of page-table level calculation in
     compute_vasz_lg2_ss(),
   - Fixes for several pre-existing issues reported by Sashiko,
   - General cleanup and refinement

  RISC-V:
   - Report cache-coherency capability for coherent devices, enabling
     VFIO/iommufd use

  Samsung Exynos:
   - Support SysMMUs without BLOCK mode, fixing their enable sequence
     and TLB invalidation
   - Improve v7 fault diagnostics with transaction information"

* tag 'iommu-updates-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (69 commits)
  MAINTAINERS: Make Vasant Hegde AMD IOMMU maintainer
  iommu/hyperv: Make hv_iommu_device static
  iommu/hyperv: Add missing PCI dependency for the guest IOMMU driver
  iommu/amd: Don't allocate kdump device table from DMA32
  iommu/amd: Program device table when kdump reuse fails
  iommu/dma: Clean up redundant MSI cookie check
  iommu/dma: Catch scatterlist length overflows
  iommu/hyperv: Add page-selective IOTLB flush support
  iommu/hyperv: Add para-virtualized IOMMU support for Hyper-V guest
  iommu/x86: Add architectural MSI reserved region helper
  Drivers: hv: Add logical device ID registry for vPCI devices
  hyperv: Introduce new hypercall interfaces used by Hyper-V guest IOMMU
  iommu: Make iommu-dma helpers private
  iommu/arm-smmu-v3: Don't rb_erase() a never-inserted stream node
  iommu/arm-smmu-v3: Add Q_POS() macro
  iommu/arm-smmu-v3: Add arm_smmu_attach_release()
  iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown
  iommu/arm-smmu-v3: Populate the tlbi at the top of the call chain
  iommu/arm-smmu-v3: Precompute the invalidation commands
  iommu/arm-smmu-v3: Keep track in arm_smmu_invs if range invalidation is used
  ...