Merge tag 'drm-next-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel

Pull drm next fixes from Dave Airlie:
 "This is the first of two fixes for the merge PRs, the other is based
  on 7.0 branch. This mostly AMD fixes, a couple of weeks of backlog
  built up and this weeks. The main complaint I've seen is some boot
  warnings around the FP code handling which this should fix. Otherwise
  a single rcar-du and a single i915 fix.

  amdgpu:
   - SMU 14 fixes
   - Partition fixes
   - SMUIO 15.x fix
   - SR-IOV fixes
   - JPEG fix
   - PSP 15.x fix
   - NBIF fix
   - Devcoredump fixes
   - DPC fix
   - RAS fixes
   - Aldebaran smu fix
   - IP discovery fix
   - SDMA 7.1 fix
   - Runtime pm fix
   - MES 12.1 fix
   - DML2 fixes
   - DCN 4.2 fixes
   - YCbCr fixes
   - Freesync fixes
   - ISM fixes
   - Overlay cursor fix
   - DC FP fixes
   - UserQ locking fixes
   - DC idle state manager fix
   - ASPM fix
   - GPUVM SVM fix
   - DCE 6 fix

  amdkfd:
   - Fix memory clear handling
   - num_of_nodes bounds check fix

  i915:
   - Fix uninitialized variable in the alignment loop [psr]

  rcar-du:
   - fix NULL-ptr crash"

* tag 'drm-next-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel: (75 commits)
  drm/amdkfd: Add upper bound check for num_of_nodes
  drm: rcar-du: Fix crash when no CMM is available
  drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x
  drm/amdgpu: OR init_pte_flags into invalid leaf PTE updates
  drm/amd: Adjust ASPM support quirk to cover more Intel hosts
  drm/amd/display: Undo accidental fix revert in amdgpu_dm_ism.c
  drm/i915/psr: Init variable to avoid early exit from et alignment loop
  drm/amdgpu: drop userq fence driver refs out of fence process()
  drm/amdgpu/userq: unpin and unref doorbell and wptr outside mutex
  drm/amdgpu/userq: use pm_runtime_resume_and_get and fix err handling
  drm/amdgpu/userq: unmap_helper dont return the queue state
  drm/amdgpu/userq: unmap is to be called before freeing doorbell/wptr bo
  drm/amdgpu/userq: hold root bo lock in caller of input_va_validate
  drm/amdgpu/userq: caller to take reserv lock for vas_list_cleanup
  drm/amdgpu/userq: create_mqd does not need userq_mutex
  drm/amdgpu/userq: dont lock root bo with userq_mutex held
  drm/amdgpu/userq: fix kerneldoc for amdgpu_userq_ensure_ev_fence
  drm/amdgpu/userq: clean the VA mapping list for failed queue creation
  drm/amdgpu/userq: avoid uneccessary locking in amdgpu_userq_create
  drm/amd/display: Fix ISM teardown crash from NULL dc dereference
  ...

3 files changed, 61 insertions, 28 deletions

diff --git a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
index c9150019aab0..f3b41087678b 100644
--- a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+++ b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
@@ -153,7 +153,7 @@ unsigned int mod_freesync_calc_v_total_from_refresh(
 		 * round down the vtotal value to avoid stretching vblank over
 		 * panel's vtotal boundary.
 		 */
-		v_total = div64_u64(div64_u64(((unsigned long long)(
+		v_total = (unsigned int)div64_u64(div64_u64(((unsigned long long)(
 				frame_duration_in_ns) * (stream->timing.pix_clk_100hz / 10)),
 				stream->timing.h_total), 1000000);
 	} else if (refresh_in_uhz >= stream->timing.max_refresh_in_uhz) {
@@ -161,11 +161,11 @@ unsigned int mod_freesync_calc_v_total_from_refresh(
 		 * round up the vtotal value to prevent off-by-one error causing
 		 * v_total_min to be below the panel's lower bound
 		 */
-		v_total = div64_u64(div64_u64(((unsigned long long)(
+		v_total = (unsigned int)div64_u64(div64_u64(((unsigned long long)(
 				frame_duration_in_ns) * (stream->timing.pix_clk_100hz / 10)),
 				stream->timing.h_total) + (1000000 - 1), 1000000);
 	} else {
-		v_total = div64_u64(div64_u64(((unsigned long long)(
+		v_total = (unsigned int)div64_u64(div64_u64(((unsigned long long)(
 				frame_duration_in_ns) * (stream->timing.pix_clk_100hz / 10)),
 				stream->timing.h_total) + 500000, 1000000);
 	}
@@ -196,11 +196,11 @@ static unsigned int calc_v_total_from_duration(
 		uint32_t h_total_up_scaled;
 
 		h_total_up_scaled = stream->timing.h_total * 10000;
-		v_total = div_u64((unsigned long long)duration_in_us
+		v_total = (unsigned int)div_u64((unsigned long long)duration_in_us
 					* stream->timing.pix_clk_100hz + (h_total_up_scaled - 1),
 					h_total_up_scaled); //ceiling for MMax and MMin for MVRR
 	} else {
-		v_total = div64_u64(div64_u64(((unsigned long long)(
+		v_total = (unsigned int)div64_u64(div64_u64(((unsigned long long)(
 					duration_in_us) * (stream->timing.pix_clk_100hz / 10)),
 					stream->timing.h_total), 1000);
 	}
@@ -232,22 +232,28 @@ static void update_v_total_for_static_ramp(
 				target_duration_in_us;
 
 	/* Calculate ratio between new and current frame duration with 3 digit */
-	unsigned int frame_duration_ratio = div64_u64(1000000,
+	uint64_t frame_duration_ratio_u64 = div64_u64(1000000,
 		(1000 +  div64_u64(((unsigned long long)(
 		STATIC_SCREEN_RAMP_DELTA_REFRESH_RATE_PER_FRAME) *
 		current_duration_in_us),
 		1000000)));
+	ASSERT(frame_duration_ratio_u64 <= 0xFFFFFFFF);
+	unsigned int frame_duration_ratio = (unsigned int)frame_duration_ratio_u64;
 
 	/* Calculate delta between new and current frame duration in us */
-	unsigned int frame_duration_delta = div64_u64(((unsigned long long)(
+	uint64_t frame_duration_delta_u64 = div64_u64(((unsigned long long)(
 		current_duration_in_us) *
 		(1000 - frame_duration_ratio)), 1000);
+	ASSERT(frame_duration_delta_u64 <= 0xFFFFFFFF);
+	unsigned int frame_duration_delta = (unsigned int)frame_duration_delta_u64;
 
 	/* Adjust frame duration delta based on ratio between current and
 	 * standard frame duration (frame duration at 60 Hz refresh rate).
 	 */
-	unsigned int ramp_rate_interpolated = div64_u64(((unsigned long long)(
+	uint64_t ramp_rate_interpolated_u64 = div64_u64(((unsigned long long)(
 		frame_duration_delta) * current_duration_in_us), 16666);
+	ASSERT(ramp_rate_interpolated_u64 <= 0xFFFFFFFF);
+	unsigned int ramp_rate_interpolated = (unsigned int)ramp_rate_interpolated_u64;
 
 	/* Going to a higher refresh rate (lower frame duration) */
 	if (ramp_direction_is_up) {
@@ -277,7 +283,7 @@ static void update_v_total_for_static_ramp(
 		}
 	}
 
-	v_total = div64_u64(div64_u64(((unsigned long long)(
+	v_total = (unsigned int)div64_u64(div64_u64(((unsigned long long)(
 			current_duration_in_us) * (stream->timing.pix_clk_100hz / 10)),
 				stream->timing.h_total), 1000);
 
@@ -1058,8 +1064,12 @@ void mod_freesync_build_vrr_params(struct mod_freesync *mod_freesync,
 		else
 			in_out_vrr->fixed_refresh_in_uhz = 0;
 
-		refresh_range = div_u64(in_out_vrr->max_refresh_in_uhz + 500000, 1000000) -
-				div_u64(in_out_vrr->min_refresh_in_uhz + 500000, 1000000);
+		{
+			uint64_t rr_tmp = div_u64(in_out_vrr->max_refresh_in_uhz + 500000, 1000000) -
+					div_u64(in_out_vrr->min_refresh_in_uhz + 500000, 1000000);
+			ASSERT(rr_tmp <= 0xFFFFFFFF);
+			refresh_range = (unsigned int)rr_tmp;
+		}
 
 		in_out_vrr->supported = true;
 	}
diff --git a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c
index df3b8383b06d..5d444e9eb38f 100644
--- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c
+++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c
@@ -250,10 +250,12 @@ static void fill_backlight_transform_table(struct dmcu_iram_parameters params,
 	unsigned int lut_index;
 
 	table->backlight_thresholds[0] = 0;
-	table->backlight_offsets[0] = params.backlight_lut_array[0];
+	ASSERT(params.backlight_lut_array[0] <= 0xFFFF);
+	table->backlight_offsets[0] = (uint16_t)params.backlight_lut_array[0];
 	table->backlight_thresholds[num_entries-1] = 0xFFFF;
+	ASSERT(params.backlight_lut_array[params.backlight_lut_array_size - 1] <= 0xFFFF);
 	table->backlight_offsets[num_entries-1] =
-		params.backlight_lut_array[params.backlight_lut_array_size - 1];
+		(uint16_t)params.backlight_lut_array[params.backlight_lut_array_size - 1];
 
 	/* Setup all brightness levels between 0% and 100% exclusive
 	 * Fills brightness-to-backlight transform table. Backlight custom curve
@@ -265,12 +267,17 @@ static void fill_backlight_transform_table(struct dmcu_iram_parameters params,
 	 */
 	for (i = 1; i+1 < num_entries; i++) {
 		lut_index = (params.backlight_lut_array_size - 1) * i / (num_entries - 1);
+
 		ASSERT(lut_index < params.backlight_lut_array_size);
 
-		table->backlight_thresholds[i] =
-			cpu_to_be16(DIV_ROUNDUP((i * 65536), num_entries));
-		table->backlight_offsets[i] =
-			cpu_to_be16(params.backlight_lut_array[lut_index]);
+		unsigned int threshold_val = DIV_ROUNDUP((i * 65536), num_entries);
+		unsigned int offset_val = params.backlight_lut_array[lut_index];
+
+		ASSERT(threshold_val <= 0xFFFF);
+		ASSERT(offset_val <= 0xFFFF);
+
+		table->backlight_thresholds[i] = cpu_to_be16((uint16_t)threshold_val);
+		table->backlight_offsets[i]    = cpu_to_be16((uint16_t)offset_val);
 	}
 }
 
@@ -282,10 +289,12 @@ static void fill_backlight_transform_table_v_2_2(struct dmcu_iram_parameters par
 	unsigned int lut_index;
 
 	table->backlight_thresholds[0] = 0;
-	table->backlight_offsets[0] = params.backlight_lut_array[0];
+	ASSERT(params.backlight_lut_array[0] <= 0xFFFF);
+	table->backlight_offsets[0] = (uint16_t)params.backlight_lut_array[0];
 	table->backlight_thresholds[num_entries-1] = 0xFFFF;
+	ASSERT(params.backlight_lut_array[params.backlight_lut_array_size - 1] <= 0xFFFF);
 	table->backlight_offsets[num_entries-1] =
-		params.backlight_lut_array[params.backlight_lut_array_size - 1];
+		(uint16_t)params.backlight_lut_array[params.backlight_lut_array_size - 1];
 
 	/* Setup all brightness levels between 0% and 100% exclusive
 	 * Fills brightness-to-backlight transform table. Backlight custom curve
@@ -299,12 +308,16 @@ static void fill_backlight_transform_table_v_2_2(struct dmcu_iram_parameters par
 		lut_index = DIV_ROUNDUP((i * params.backlight_lut_array_size), num_entries);
 		ASSERT(lut_index < params.backlight_lut_array_size);
 
+		unsigned int threshold_val = DIV_ROUNDUP((i * 65536), num_entries);
+		unsigned int offset_val = params.backlight_lut_array[lut_index];
+
+		ASSERT(threshold_val <= 0xFFFF);
+		ASSERT(offset_val <= 0xFFFF);
+
 		table->backlight_thresholds[i] = (big_endian) ?
-			cpu_to_be16(DIV_ROUNDUP((i * 65536), num_entries)) :
-			cpu_to_le16(DIV_ROUNDUP((i * 65536), num_entries));
+			cpu_to_be16((uint16_t)threshold_val) : cpu_to_le16((uint16_t)threshold_val);
 		table->backlight_offsets[i] = (big_endian) ?
-			cpu_to_be16(params.backlight_lut_array[lut_index]) :
-			cpu_to_le16(params.backlight_lut_array[lut_index]);
+			cpu_to_be16((uint16_t)offset_val) : cpu_to_le16((uint16_t)offset_val);
 	}
 }
 
@@ -740,9 +753,12 @@ bool dmub_init_abm_config(struct resource_pool *res_pool,
 	}
 
 	if (params.backlight_ramping_override) {
+
+		ASSERT(params.backlight_ramping_reduction <= 0xFFFF);
+		ASSERT(params.backlight_ramping_start <= 0xFFFF);
 		for (i = 0; i < NUM_AGGR_LEVEL; i++) {
-			config.blRampReduction[i] = params.backlight_ramping_reduction;
-			config.blRampStart[i] = params.backlight_ramping_start;
+			config.blRampReduction[i] = (uint16_t)params.backlight_ramping_reduction;
+			config.blRampStart[i]     = (uint16_t)params.backlight_ramping_start;
 		}
 	} else {
 		for (i = 0; i < NUM_AGGR_LEVEL; i++) {
@@ -1060,6 +1076,7 @@ void calculate_replay_link_off_frame_count(struct dc_link *link,
 bool fill_custom_backlight_caps(unsigned int config_no, struct dm_acpi_atif_backlight_caps *caps)
 {
 	unsigned int data_points_size;
+	uint64_t caps_size;
 
 	if (config_no >= ARRAY_SIZE(custom_backlight_profiles))
 		return false;
@@ -1067,7 +1084,9 @@ bool fill_custom_backlight_caps(unsigned int config_no, struct dm_acpi_atif_back
 	data_points_size = custom_backlight_profiles[config_no].num_data_points
 			* sizeof(custom_backlight_profiles[config_no].data_points[0]);
 
-	caps->size = sizeof(struct dm_acpi_atif_backlight_caps) - sizeof(caps->data_points) + data_points_size;
+	caps_size = sizeof(struct dm_acpi_atif_backlight_caps) - sizeof(caps->data_points) + data_points_size;
+	ASSERT(caps_size <= 0xFFFF);
+	caps->size = (uint16_t)caps_size;
 	caps->flags = 0;
 	caps->error_code = 0;
 	caps->ac_level_percentage = custom_backlight_profiles[config_no].ac_level_percentage;
diff --git a/drivers/gpu/drm/amd/display/modules/vmid/vmid.c b/drivers/gpu/drm/amd/display/modules/vmid/vmid.c
index 9f408cb11ac9..179b505f7777 100644
--- a/drivers/gpu/drm/amd/display/modules/vmid/vmid.c
+++ b/drivers/gpu/drm/amd/display/modules/vmid/vmid.c
@@ -57,7 +57,10 @@ static void clear_entry_from_vmid_table(struct core_vmid *core_vmid, unsigned in
 static void evict_vmids(struct core_vmid *core_vmid)
 {
 	int i;
-	uint16_t ord = dc_get_vmid_use_vector(core_vmid->dc);
+	int ord_int = dc_get_vmid_use_vector(core_vmid->dc);
+
+	ASSERT(ord_int >= 0 && ord_int <= 0xFFFF);
+	uint16_t ord = (uint16_t)ord_int;
 
 	// At this point any positions with value 0 are unused vmids, evict them
 	for (i = 1; i < core_vmid->num_vmid; i++) {
@@ -120,7 +123,8 @@ uint8_t mod_vmid_get_for_ptb(struct mod_vmid *mod_vmid, uint64_t ptb)
 			ASSERT(0);
 	}
 
-	return vmid;
+	ASSERT(vmid >= 0 && vmid <= 0xFF);
+	return (uint8_t)vmid;
 }
 
 void mod_vmid_reset(struct mod_vmid *mod_vmid)