tgl-display: the DMC's program loaded, PG3-PG5 down and DC6 allowed (stage 2)

NOTICE

@@ -748,6 +748,35 @@ parses is read. Whether the cards verify these files is unconfirmed:
 issues/nothing-shows-the-ax200-or-ax210-verifies-its-firmware.md.
 
 
+system/tgl-display/firmware/* — Intel display firmware, redistributable unmodified
+-----------------------------------------------------------------------------------
+
+    tgl_dmc_ver2_12.bin  19,760 bytes, Tiger Lake's Display Micro-Controller
+                         package, version 2.12
+      sha256 3c013ef0ad96ba73aee8e5bd04a8e27cc9b1c6e9183b1a83ce124485f325afca
+    Upstream: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git,
+    `i915/` at tag 20261019 (commit a2dcb924f0897368b0b4f305cbf9808cdda90ce0),
+    byte for byte
+    Copyright: Intel Corporation
+    Licence text: licenses/Intel-i915-firmware-license.txt (upstream's
+    `LICENSES/LICENSE.i915` at that commit, which WHENCE names
+    LicenseRef-LICENSE.i915,
+    sha256 8542aeabf2761935122d693561e16766ce1bcc2b0d003204f9040b7d6d929f2e)
+    SPDX-License-Identifier: LicenseRef-Intel-i915-Firmware
+
+The newest Tiger Lake build at that tag. `toyos-tgl-display` embeds it, and
+the `tgl-display` driver loads its main program into the display engine's
+program storage through its own registers. An image building `tgl-display`
+carries the licence as /system/share/licenses/Intel-i915-firmware-license.txt.
+The licence permits redistribution in binary form, without modification, on
+three conditions: the copyright notice and the disclaimer are reproduced with
+the distribution; Intel's name endorses nothing derived from it; and no
+reverse engineering, decompilation or disassembly, so of the file only the
+headers Vol 12 "DMC Firmware Package" lays out are read. Its patent licence
+covers use alone or with an operating system under an OSI-approved licence.
+Whether the display engine verifies the program is unknown:
+issues/nothing-shows-the-tiger-lake-display-engine-verifies-its-dmc-program.md.
+
 tests/cavp/SHA*.rsp — NIST's SHA-2 test vectors, CAVP SHAVS
 ------------------------------------------------------------
 

build/build.rs

@@ -943,6 +943,15 @@ pub const MICROCODE_LICENCES: [(&str, &[u8]); 2] = [
     ("share/licenses/Intel-microcode-license.txt", include_bytes!("../licenses/Intel-microcode-license.txt")),
 ];
 
+/// The program that embeds Intel's display firmware, where on ROOT that
+/// firmware's licence is, and its text: the licence asks that a
+/// redistribution carry it.
+pub const DISPLAY_FIRMWARE_LICENCE: (&str, &str, &[u8]) = (
+    "tgl-display",
+    "share/licenses/Intel-i915-firmware-license.txt",
+    include_bytes!("../licenses/Intel-i915-firmware-license.txt"),
+);
+
 /// The Mozilla root program's authorities as `webpki-root-certs` publishes
 /// them, each certificate a PEM block in the published order.
 pub fn trust_roots() -> Vec<u8> {
@@ -982,6 +991,10 @@ fn build_and_assemble(
     }
 
     root_files.push((TRUST_ROOTS.to_string(), trust_roots()));
+    let (embedder, path, text) = DISPLAY_FIRMWARE_LICENCE;
+    if programs.contains(embedder) {
+        root_files.push((path.to_string(), text.to_vec()));
+    }
     root_files.push((TRUST_ROOTS_LICENCE.0.to_string(), TRUST_ROOTS_LICENCE.1.to_vec()));
     match arch {
         Arch::X86_64 => {

build/licence.rs

@@ -90,7 +90,7 @@ const DATA_ONLY: &[&str] = &["CDLA-Permissive-2.0"];
 /// Allowed for a [`Terms::Firmware`] row, and nowhere else: vendor firmware
 /// the owner ruled may ship, pinned and unmodified.
 const FIRMWARE_ONLY: &[&str] =
-    &["LicenseRef-AMD-Microcode", "LicenseRef-Intel-Microcode", "LicenseRef-Intel-iwlwifi-Firmware"];
+    &["LicenseRef-AMD-Microcode", "LicenseRef-Intel-Microcode", "LicenseRef-Intel-iwlwifi-Firmware", "LicenseRef-Intel-i915-Firmware"];
 
 /// What a licence is judged as: [`FONTS_ONLY`] passes only for a font,
 /// [`DATA_ONLY`] only for the trust roots and [`FIRMWARE_ONLY`] only for
@@ -1136,6 +1136,12 @@ pub const COMMITTED_FILES: &[(&str, &str, &str, Terms)] = &[
         "NOTICE",
         Terms::Firmware("LicenseRef-Intel-iwlwifi-Firmware"),
     ),
+    (
+        "system/tgl-display/firmware/tgl_dmc_ver2_12.bin",
+        "3c013ef0ad96ba73aee8e5bd04a8e27cc9b1c6e9183b1a83ce124485f325afca",
+        "NOTICE",
+        Terms::Firmware("LicenseRef-Intel-i915-Firmware"),
+    ),
 ];
 
 /// `NOTICE` sections that name no files, and why.

issues/each-gpu-drives-its-displays-from-a-userland-driver.md

@@ -79,14 +79,21 @@ The kernel keeps only generic mechanisms:
    - **Exit:** on the T14 with the panel lit, `osbench energy`'s idle row reads PC2 at most 400 ‰ and PC3 at least 600 ‰.
      - That is the residency stopping the plane's fetches altogether gave (pr-1100 r7: 338 ‰ and 656 ‰). PC3 is the most this stage can show until NVMe APST lands, because the NVMe caps the package there.
      - The power figure against Linux's 1622 mW idle is judged once APST lands.
-2. **Intel DMC and DC5/DC6** (Intel's signed payload, pinned by version and hash), and
-3. **PSR on the eDP panel**. The display task measures these two together. DC5 with a pipe running needs PSR active (Vol 12, "Display C5 and C6"), so stage 2 alone saves nothing with the panel lit. PSR's first-frame exit latency goes to the owner in absolute numbers before PSR lands.
-4. **`display-output`.** The compositor moves onto it, with virtio-gpu and the framebuffer as drivers. The panic surface lands here.
-5. **Intel modesetting**: combo-PHY DDIs, DPLLs and CDCLK, DP link training with DSC, HDMI 2.0 with SCDC, EDID over AUX and GMBUS, several outputs.
-6. **Intel Type-C DP alt mode**: FIA/IOM state, TCCOLD, the Dekel PHY, hotplug.
-7. **Intel high refresh and VRR.**
-8. **AMD**: the Display Core adapter, to the same protocol.
-9. **Display audio.**
+2. **Intel DMC and DC5/DC6.** Intel's package, pinned by version and hash (`NOTICE`), with its main program loaded through the iGPU's own registers.
+   - PG3-PG5 are powered down, since the GOP leaves PG1-PG4 requested. PG1 holds pipe A, transcoder A with its PSR, and DDI A-C. AUDIO_PIN_BUF_CTL's enable is cleared after PG3 (Vol 12 "Audio Bios Programming Sequence"). Then DC6 is allowed.
+   - DC6 is allowed only with the panel on DDI A, since Vol 12 says only port A's PHY programming survives it.
+   - With the pipe lit, the engine enters DC5 only while PSR is active (Vol 12, "Display C5 and C6"), so this stage alone saves little.
+   - What it can show alone is the program held in storage, PG3-PG5 off, and the scan-out and `hda` unharmed. `hda`'s display codec is in PG3.
+3. **Present and damage.** The `display-output` piece PSR needs is the compositor telling the driver which frame changed, and where. Otherwise PSR1 sees a CPU write only through FBC host tracking of a graphics-aperture fence (Vol 12 "CPU Host Front Buffer Tracking", "on projects that support that"). Whether that reaches the GOP's surface is unverified. This is ordered before PSR, rather than an interim signal. Its shape goes to the orchestrator before it is built, because it crosses the compositor.
+4. **PSR on the eDP panel**, measured together with stage 2. PSR's first-frame exit latency goes to the owner in absolute numbers before PSR lands.
+5. **The rest of `display-output`.** virtio-gpu and the framebuffer become drivers. The panic surface lands here.
+6. **Intel modesetting**: combo-PHY DDIs, DPLLs and CDCLK, DP link training with DSC, HDMI 2.0 with SCDC, EDID over AUX and GMBUS, several outputs.
+7. **Intel Type-C DP alt mode**: FIA/IOM state, TCCOLD, the Dekel PHY, hotplug.
+8. **Intel high refresh and VRR.**
+9. **AMD**: the Display Core adapter, to the same protocol.
+10. **Display audio.**
+    - PG3 holds `hda`'s display codec, and since stage 2 `tgl-display` powers it down on its own. Display audio needs `hda` to ask the display driver for PG3.
+    - Vol 12 "Audio Programming Sequence for Link Wakeup" orders the iDisp link: the audio driver stops it (LCTL1.SPA = 0, then CPA = 0) before AUDIO_PIN_BUF_CTL is cleared. Today only the buffer is cleared, after PG3, so the two drivers must coordinate here.
 
 ## Tests
 

issues/nothing-shows-the-tiger-lake-display-engine-verifies-its-dmc-program.md

@@ -0,0 +1,33 @@
+---
+status: open
+kind: defect
+opened: 2026-11-01
+---
+
+# Nothing shows the Tiger Lake display engine verifies its DMC program
+
+The tree carries Intel's Tiger Lake DMC package unmodified, pinned by hash
+(`system/tgl-display/firmware/`, `NOTICE`). `tgl-display` loads its main
+program into the display engine's CSR program storage through the iGPU's own
+registers. Root `CLAUDE.md`'s firmware rule lets it ship: it is device
+firmware, and what the display engine masters is behind the iGPU's VT-d
+domain.
+
+Nothing on record shows that the engine verifies the program before running
+it:
+
+- Vol 12-12.21 "DMC Firmware Package" marks the CSS header's `keySize`,
+  `modulusSize` and `exponentSize` "Not used".
+- The pinned file's CSS header carries 0 in all three. Its CSS `size` covers
+  the whole 19,760-byte file as header, package header and programs, which
+  leaves no room for a key or a signature.
+- No Vol 12 or Vol 2c text states a check.
+
+So, as far as the record shows, the program is unsigned. The hash pin keeps
+an altered file out of a signed image, but it decides nothing about what the
+engine accepts from a driver that hands it one.
+
+**Owner**: the orchestrator.
+
+**Exit**: an Intel statement, cited in the driver, that the engine verifies
+the program before running it, and this file deleted.

licenses/Intel-i915-firmware-license.txt

@@ -0,0 +1,39 @@
+Copyright (c) 2015, Intel Corporation.
+All rights reserved.
+
+Redistribution.  Redistribution and use in binary form, without
+modification, are permitted provided that the following conditions are
+met:
+
+* Redistributions must reproduce the above copyright notice and the
+  following disclaimer in the documentation and/or other materials
+  provided with the distribution.
+* Neither the name of Intel Corporation nor the names of its suppliers
+  may be used to endorse or promote products derived from this software
+  without specific prior written permission.
+* No reverse engineering, decompilation, or disassembly of this software
+  is permitted.
+
+Limited patent license.  Intel Corporation grants a world-wide,
+royalty-free, non-exclusive license under patents it now or hereafter
+owns or controls to make, have made, use, import, offer to sell and
+sell ("Utilize") this software, but solely to the extent that any
+such patent is necessary to Utilize the software alone, or in
+combination with an operating system licensed under an approved Open
+Source license as listed by the Open Source Initiative at
+http://opensource.org/licenses.  The patent license shall not apply to
+any other combinations which include this software.  No hardware per
+se is licensed hereunder.
+
+DISCLAIMER.  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
+CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
+BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGE.