Pull drm fixes from Dave Airlie:
 "These are just the fixes from our fixes branch, all pretty small and
  scattered.

  sysfb:
   - drm/sysfb truncation and alignment fixes

  edid:
   - fix edid OOB read in tile parsing
   - increase displayid topology id to correct size

  nouveau:
   - fix error handling paths in nouveau

  amdxdna:
   - get_bo_info fix

  ivpu:
   - fix leak when error handling in ivpu"

* tag 'drm-fixes-2026-06-27' of https://gitlab.freedesktop.org/drm/kernel:
  drm/sysfb: Avoid truncating maximum stride
  drm/sysfb: Return errno code from drm_sysfb_get_visible_size()
  drm/sysfb: Avoid possible truncation with calculating visible size
  drm/sysfb: Do not page-align visible size of the framebuffer
  drm/edid: fix OOB read in drm_parse_tiled_block()
  drm/nouveau: fix reversed error cleanup order in ucopy functions
  drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
  accel/amdxdna: Use caller client for debug BO sync
  drm/displayid: fix Tiled Display Topology ID size
  accel/ivpu: fix HWS command queue leak on registration failure

Pull drm merge window fixes from Dave Airlie:
 "This is the merge window fixes from our next tree, i915/xe and amdgpu
  make up all of it.

  I've got a separate fixes pull from our fixes branch arriving after
  this.

  i915:
   - Fix corrupted display output on GLK, #16209
   - Add missing Spectre mitigation for parallel submit IOCTL
   - MTL+ fix for DP resume
   - clear CRTC blobs after dropping refs
   - fix sharpness filter on DP MST

  xe:
   - Set TTM beneficial order to 9 in Xe
   - Several error path cleanups
   - Fix TDR for unstarted jobs on kernel queues
   - Several TLB invalidation fixes related to suspending LR queues
   - Some small RAS fixes
   - Multi-queue suspend fix for LR queues
   - Revert inclusion of NVL_S firmware

  amdgpu:
   - devcoredump fixes
   - SMU15 fix
   - Various irq put/get imbalance cleanup fixes
   - 8K panel fix
   - DCN3.5 fix
   - lockdep fix
   - Cleaner shader sysfs IB overflow fix
   - Async flip fixes
   - GET_MAPPING_INFO fix
   - CP_GFX_SHADOW fix
   - Ctx pstate handling fix
   - GTT bo move handling fixes
   - Old UVD BO placement fixes
   - GC9 mode2 reset fix
   - IH6.1 version fix
   - Soft IH ring fix

  amdkfd:
   - Fix doorbell/mmio double unpin on free
   - CRIU fixes
   - SMI event fixes
   - Sysfs teardown fix
   - Various boundary checking fixes
   - Various error checking fixes
   - SVM fix"

* tag 'drm-next-2026-06-27' of https://gitlab.freedesktop.org/drm/kernel: (52 commits)
  drm/i915/cdclk: Fix up CDCLK_FREQ_DECIMAL without a full PLL re-enable
  drm/i915/gem: Add missing nospec on parallel submit slot
  drm/amdgpu: Use system unbound workqueue for soft IH ring
  amdgpu/ih6.1: Fix minor version
  drm/amdkfd: Use exclusive bounds for SVM split alignment checks
  drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2
  drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2)
  drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
  drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
  drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
  drm/amdgpu: Fix context pstate override handling
  drm/amdkfd: Use memdup_array_user to copy data from/to user space at kfd ioctls
  drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap
  drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl
  drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
  drm/amdgpu: convert amdgpu_vm_lock_by_pasid() to drm_exec
  drm/amdgpu: Don't use UTS_RELEASE directly
  drm/amdkfd: Fix NULL deref during sysfs teardown
  drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
  drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO
  ...

drm-misc-fixes for v7.2:
- drm/sysfb truncation and alignment fixes.
- fix edid OOB read.
- fix error handling paths in nouveau
- amdxdna get_bo_info fix.
- increase displayid topology id to correct size.
- fix leak when error handling in ivpu.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patch.msgid.link/2d17f718-43f5-4772-9c04-a975c9ad4bc3@linux.intel.com

- Fix corrupted display output on GLK, #16209 (Ville)
- Add missing Spectre mitigation for parallel submit IOCTL (Joonas)

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: https://patch.msgid.link/ajzIhInnHnGCwMlu@jlahtine-mobl

The GOP (and even Bspec on some platforms) is a bit inconsistent
on what the CDCLK_FREQ_DECIMAL divider should be. Currently any
mismatch there causes a full CDCLK PLL disable+re-enable, which
we really don't want to do if any displays are currently active.
Let's instead just reprogram CDCLK_FREQ_DECIMAL when that is the
only thing amiss. For any other (more serious) mismatch we still
punt to the full PLL reprogramming.

We also need to tweak the bxt_cdclk_cd2x_pipe() stuff a bit to
consistently select pipe==NONE since we have no idea which pipes
are enabled at this point. Since we're not actually changing the
CDCLK frequency here we don't need to sync the update to any
pipe.

Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16209
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260612173653.7830-2-ville.syrjala@linux.intel.com
Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
(cherry picked from commit 3f9de66f8acbf8ff45a91b4920605ed10c6b7c06)
Fixes: ba91b9eecb47 ("drm/i915/cdclk: Decouple cdclk from state->modeset")
Fixes: d66a21947e21 ("drm/i915/bxt: Sanitize CDCLK to fix breakage during S4 resume")
Fixes: c73666f394fc ("drm/i915/skl: If needed sanitize bios programmed cdclk")
Cc: <stable@vger.kernel.org> # v4.5+
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>

Add missing Spectre mitigation for userspace controlled parallel
submission slot.

Discovered using AI-assisted static analysis confirmed by Intel
Product Security.

Reported-by: Martin Hodo <martin.hodo@intel.com>
Fixes: e5e32171a2cf ("drm/i915/guc: Connect UAPI to GuC multi-lrc interface")
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Tvrtko Ursulin <tursulin@ursulin.net>
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: <stable@vger.kernel.org> # v5.16+
Link: https://patch.msgid.link/20260622132539.165558-1-joonas.lahtinen@linux.intel.com
(cherry picked from commit 15b9353deff3cf72331c387780de3cf9c316b643)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>

Passing a maximum as 64-bit type to drm_sysfb_get_validated_int0()
can truncate the value to 32 bits. Use drm_sysfb_get_validated_size0(),
which uses 64-bit arithmetics. Then test the returned stride against
the limits of int to avoid truncations in the returned value. A valid
stride is in the range of [1, INT_MAX] inclusive.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/dri-devel/20260617114016.5A5991F000E9@smtp.kernel.org/
Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays")
Fixes: a84eb6abe2b6 ("drm/sysfb: Add vesadrm for VESA displays")
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.16+
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patch.msgid.link/20260618084327.46567-5-tzimmermann@suse.de

Change the return type of drm_sysfb_get_visible_size() to s64 so
that it returns a possible errno code from _get_validated_size0().
Fix callers to handle the errno code.

The currently returned unsigned type converts an errno code to a
very large size value, which drivers interpret as visible size of
the system framebuffer. Later efforts to reserve the framebuffer
resource fail.

The bug has been present since efidrm and vesadrm got merged. It
was then part of each driver.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays")
Fixes: a84eb6abe2b6 ("drm/sysfb: Add vesadrm for VESA displays")
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.16+
Link: https://patch.msgid.link/20260618084327.46567-4-tzimmermann@suse.de

Calculating the visible size of the system framebuffer can result in
truncation of the result. The calculation uses 32-bit arithmetics,
which can overflow if the values for height and stride are large. Fix
the issue by multiplying with mul_u32_u32().

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays")
Fixes: a84eb6abe2b6 ("drm/sysfb: Add vesadrm for VESA displays")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/dri-devel/20260617114027.1F2A71F000E9@smtp.kernel.org/
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.16+
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patch.msgid.link/20260618084327.46567-3-tzimmermann@suse.de

Only return the actually visible size of the system framebuffer in
drm_sysfb_get_visible_size_si(). Drivers use this size value for
reserving access to framebuffer memory. Increasing the value can
make later attempts to do so fail.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays")
Fixes: a84eb6abe2b6 ("drm/sysfb: Add vesadrm for VESA displays")
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.16+
Link: https://patch.msgid.link/20260618084327.46567-2-tzimmermann@suse.de