--- /dev/null
+From 000acb4ce7fb9feba3072ce468ad681f6585cd5d Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 16 Feb 2026 09:32:53 -0500
+Subject: drm/amd/display: check if dml21_add_phantom_plane() is successful
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 000acb4ce7fb9feba3072ce468ad681f6585cd5d upstream.
+
+Verify that the phantom plane was allocated to avoid a later
+segfault.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4970
+Fixes: 70839da63605 ("drm/amd/display: Add new DCN401 sources")
+Reviewed-by: Dillon Varone <dillon.varone@amd.com>
+Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_utils.c | 15 ++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_utils.c
++++ b/drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_utils.c
+@@ -359,14 +359,13 @@ void dml21_handle_phantom_streams_planes
+ main_plane = main_stream_status->plane_states[dc_plane_index];
+
+ /* create phantom planes for subvp enabled plane */
+- dml21_add_phantom_plane(dml_ctx,
+- dc,
+- context,
+- phantom_stream,
+- main_plane,
+- &dml_ctx->v21.mode_programming.programming->plane_programming[dml_plane_index]);
+-
+- phantoms_added = true;
++ if (dml21_add_phantom_plane(dml_ctx,
++ dc,
++ context,
++ phantom_stream,
++ main_plane,
++ &dml_ctx->v21.mode_programming.programming->plane_programming[dml_plane_index]))
++ phantoms_added = true;
+ }
+ }
+ }
--- /dev/null
+From f327e389c07cfc3a2f6ff54f6214e1a52d457edc Mon Sep 17 00:00:00 2001
+From: George Zhang <george.zhang@amd.com>
+Date: Thu, 16 Jul 2026 17:00:01 -0400
+Subject: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
+
+From: George Zhang <george.zhang@amd.com>
+
+commit f327e389c07cfc3a2f6ff54f6214e1a52d457edc upstream.
+
+If a plane reaches calculate_mcache_setting with a zero-area viewport,
+calculate_mcache_setting exits early with num_mcaches == 0 and
+mvmpg_width/height == 0. This will cause a divide-by-zero panic and can
+also cause an underflow on num_mcaches.
+
+Fix this by changing calculate_mcache_setting to bool and adding guards
+after each calculate_mcache_row_bytes call. If num_mcaches or
+mvmpg_width/height is zero, return a false. Callers will propagate the
+failure as a rejected mode, which prevents the panic.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5302
+Reviewed-by: Sun peng (Leo) Li <sunpeng.li@amd.com>
+Reviewed-by: Dillon Varone <dillon.varone@amd.com>
+Signed-off-by: George Zhang <george.zhang@amd.com>
+Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 29c0f7c655f47bcbd575ff75e58480df6ec3c9da)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 31 ++++++++--
+ 1 file changed, 25 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
++++ b/drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
+@@ -2425,7 +2425,7 @@ static void calculate_mcache_row_bytes(
+ DML_ASSERT(*p->num_mcaches > 0);
+ }
+
+-static void calculate_mcache_setting(
++static bool calculate_mcache_setting(
+ struct dml2_core_internal_scratch *scratch,
+ struct dml2_core_calcs_calculate_mcache_setting_params *p)
+ {
+@@ -2451,7 +2451,7 @@ static void calculate_mcache_setting(
+ *p->lc_comb_mcache = 0;
+
+ if (!p->dcc_enable)
+- return;
++ return true;
+
+ l->is_dual_plane = dml_is_420(p->source_format) || p->source_format == dml2_rgbe_alpha;
+
+@@ -2488,7 +2488,14 @@ static void calculate_mcache_setting(
+ l->l_p.mvmpg_per_mcache_lb = &l->mvmpg_per_mcache_lb_l;
+
+ calculate_mcache_row_bytes(scratch, &l->l_p);
+- DML_ASSERT(*p->num_mcaches_l > 0);
++ if (*p->num_mcaches_l == 0 ||
++ (p->surf_vert ? l->mvmpg_height_l : l->mvmpg_width_l) == 0) {
++ DML_LOG_VERBOSE("DML::%s: degenerate luma viewport (num_mcaches_l=%u mvmpg_%s_l=%u) — mode not supported\n",
++ __func__, *p->num_mcaches_l,
++ p->surf_vert ? "height" : "width",
++ p->surf_vert ? l->mvmpg_height_l : l->mvmpg_width_l);
++ return false;
++ }
+
+ if (l->is_dual_plane) {
+ l->c_p.num_chans = p->num_chans;
+@@ -2524,7 +2531,14 @@ static void calculate_mcache_setting(
+ l->c_p.mvmpg_per_mcache_lb = &l->mvmpg_per_mcache_lb_c;
+
+ calculate_mcache_row_bytes(scratch, &l->c_p);
+- DML_ASSERT(*p->num_mcaches_c > 0);
++ if (*p->num_mcaches_c == 0 ||
++ (p->surf_vert ? l->mvmpg_height_c : l->mvmpg_width_c) == 0) {
++ DML_LOG_VERBOSE("DML::%s: degenerate chroma viewport (num_mcaches_c=%u mvmpg_%s_c=%u) — mode not supported\n",
++ __func__, *p->num_mcaches_c,
++ p->surf_vert ? "height" : "width",
++ p->surf_vert ? l->mvmpg_height_c : l->mvmpg_width_c);
++ return false;
++ }
+ }
+
+ // Sharing for iMALL access
+@@ -2634,6 +2648,7 @@ static void calculate_mcache_setting(
+
+ *p->mcache_shift_granularity_l = l->mvmpg_access_width_l;
+ *p->mcache_shift_granularity_c = l->mvmpg_access_width_c;
++ return true;
+ }
+
+ static void calculate_mall_bw_overhead_factor(
+@@ -9430,7 +9445,10 @@ static bool dml_core_mode_support(struct
+ calculate_mcache_setting_params->mall_comb_mcache_c = &mode_lib->ms.mall_comb_mcache_c[k];
+ calculate_mcache_setting_params->lc_comb_mcache = &mode_lib->ms.lc_comb_mcache[k];
+
+- calculate_mcache_setting(&mode_lib->scratch, calculate_mcache_setting_params);
++ if (!calculate_mcache_setting(&mode_lib->scratch, calculate_mcache_setting_params)) {
++ mode_lib->ms.support.ModeSupport = false;
++ return false;
++ }
+ }
+
+ calculate_mall_bw_overhead_factor(
+@@ -10906,7 +10924,8 @@ static bool dml_core_mode_programming(st
+ calculate_mcache_setting_params->mall_comb_mcache_l = &mode_lib->mp.mall_comb_mcache_l[k];
+ calculate_mcache_setting_params->mall_comb_mcache_c = &mode_lib->mp.mall_comb_mcache_c[k];
+ calculate_mcache_setting_params->lc_comb_mcache = &mode_lib->mp.lc_comb_mcache[k];
+- calculate_mcache_setting(&mode_lib->scratch, calculate_mcache_setting_params);
++ if (!calculate_mcache_setting(&mode_lib->scratch, calculate_mcache_setting_params))
++ return false;
+ }
+
+ calculate_mall_bw_overhead_factor(
--- /dev/null
+From c216b39fbbc4b007fd6984cffd85039d49a55154 Mon Sep 17 00:00:00 2001
+From: Ray Wu <ray.wu@amd.com>
+Date: Fri, 3 Jul 2026 09:14:49 +0800
+Subject: drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
+
+From: Ray Wu <ray.wu@amd.com>
+
+commit c216b39fbbc4b007fd6984cffd85039d49a55154 upstream.
+
+Some HDMI sinks need additional GCP packets to properly process the
+mute state before the timing generator is disabled, especially after
+link re-establishment with HDMI 2.0 scrambling enabled. Waiting for
+only 2 frames is insufficient for certain monitor firmware, resulting
+in garbled display output on resume from suspend.
+
+Increase the AV mute wait in dcn30_set_avmute() from 2 to 3 frames
+to ensure the sink receives enough GCP packets.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5167
+Assisted-by: Cursor:Claude-Opus-4.6
+Reviewed-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 0c0d5174b09640d8b560764aa5a177630e076e93)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c
+@@ -841,13 +841,19 @@ void dcn30_set_avmute(struct pipe_ctx *p
+ pipe_ctx->stream_res.stream_enc,
+ enable);
+
+- /* Wait for two frame to make sure AV mute is sent out */
++ /* Wait for three frames to make sure AV mute is sent out.
++ * Some HDMI sinks need additional GCP packets to properly
++ * process the mute state, especially after link re-establishment
++ * with HDMI 2.0 scrambling enabled.
++ */
+ if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) {
++ int i;
++
+ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
+- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK);
+- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
+- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK);
+- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
++ for (i = 0; i < 3; i++) {
++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK);
++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
++ }
+ }
+ }
+ }
--- /dev/null
+From 8ccb87b1c9be594fc2c36b0a4006a66f08dee1c8 Mon Sep 17 00:00:00 2001
+From: Alan Swanson <reiver@improbability.net>
+Date: Mon, 27 Jul 2026 17:01:26 +0100
+Subject: drm/amd/display: Silence link_dpms I2C retimer failures
+
+From: Alan Swanson <reiver@improbability.net>
+
+commit 8ccb87b1c9be594fc2c36b0a4006a66f08dee1c8 upstream.
+
+Commit a4f01bf729b2 ("drm/amd/display: Refactor and fix link_dpms I2C")
+had also changed the "Set retimer failed" messages from DC_LOG_DEBUG()
+to DC_LOG_ERROR(). This unfortunately can create log spam.
+
+Change those back to DC_LOG_DEBUG() only.
+
+Fixes: a4f01bf729b2 ("drm/amd/display: Refactor and fix link_dpms I2C")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5520
+Signed-off-by: Alan Swanson <reiver@improbability.net>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit da8609eef18b0a3490d0e1fa9440659fadc8194d)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+@@ -379,7 +379,7 @@ static bool write_i2c_retimer_vga(
+
+ for (size_t i = 0; i < ARRAY_SIZE(vga_data); i++) {
+ if (!write_i2c_retimer_offset_value(link, address, vga_data[i][0], vga_data[i][1])) {
+- DC_LOG_ERROR("Set retimer failed, vga index: %zu\n", i);
++ DC_LOG_DEBUG("Set retimer failed, vga index: %zu\n", i);
+ return false;
+ }
+ }
+@@ -400,7 +400,7 @@ static bool write_i2c_retimer_byte(
+ return true;
+
+ if (!write_i2c_retimer_offset_value(link, address, index, value)) {
+- DC_LOG_ERROR("Set retimer failed, 3g index: 0x%x, value: 0x%x\n", index, value);
++ DC_LOG_DEBUG("Set retimer failed, 3g index: 0x%x, value: 0x%x\n", index, value);
+ return false;
+ }
+
+@@ -416,14 +416,14 @@ static bool write_i2c_retimer_byte(
+ if (!link_query_ddc_data(
+ link->ddc, address, &offset, 1, &value, 1
+ )) {
+- DC_LOG_ERROR("Set retimer failed, link_query_ddc_data\n");
++ DC_LOG_DEBUG("Set retimer failed, link_query_ddc_data\n");
+ return false;
+ }
+ }
+
+ value |= apply_rx_tx_change;
+ if (!write_i2c_retimer_offset_value(link, address, offset, value)) {
+- DC_LOG_ERROR("Set retimer failed, 3g offset: 0x%x, value: 0x%x\n", offset, value);
++ DC_LOG_DEBUG("Set retimer failed, 3g offset: 0x%x, value: 0x%x\n", offset, value);
+ return false;
+ }
+ }
+@@ -444,7 +444,7 @@ static bool write_i2c_retimer_setting(
+ uint8_t value = settings->reg_settings[i].i2c_reg_val;
+
+ if (!write_i2c_retimer_byte(link, address, index, value)) {
+- DC_LOG_ERROR("Set retimer failed, index: %zu\n", i);
++ DC_LOG_DEBUG("Set retimer failed, index: %zu\n", i);
+ return false;
+ }
+ }
+@@ -455,7 +455,7 @@ static bool write_i2c_retimer_setting(
+ uint8_t value = settings->reg_settings_6g[i].i2c_reg_val;
+
+ if (!write_i2c_retimer_byte(link, address, index, value)) {
+- DC_LOG_ERROR("Set retimer failed, 6g index: %zu\n", i);
++ DC_LOG_DEBUG("Set retimer failed, 6g index: %zu\n", i);
+ return false;
+ }
+ }
+@@ -487,7 +487,7 @@ static bool write_i2c_default_retimer_se
+
+ for (size_t i = 0; i < ARRAY_SIZE(data); i++) {
+ if (!write_i2c_retimer_offset_value(link, address, data[i][0], data[i][1])) {
+- DC_LOG_ERROR("Set default retimer failed, index: %zu\n", i);
++ DC_LOG_DEBUG("Set default retimer failed, index: %zu\n", i);
+ return false;
+ }
+ }
+@@ -519,7 +519,7 @@ static bool write_i2c_redriver_setting(
+ );
+
+ if (!success)
+- DC_LOG_ERROR("Set redriver failed");
++ DC_LOG_DEBUG("Set redriver failed");
+ return success;
+ }
+
--- /dev/null
+From 114b42507b6a23d9d24e24e4ef165233332c64d4 Mon Sep 17 00:00:00 2001
+From: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
+Date: Thu, 23 Jul 2026 06:25:48 +0200
+Subject: drm/amd/display: use proper context for logging
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+
+commit 114b42507b6a23d9d24e24e4ef165233332c64d4 upstream.
+
+The same as the rest of the code, get_ss_info_from_atombios() uses
+calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is
+initialized only later in calc_pll_max_vco_construct(). Therefore, any
+output using DC_LOG_SYNC() leads to a NULL pointer deference in
+get_ss_info_from_atombios().
+
+According to Sashiko, the very same problem exists in
+dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too.
+
+To avoid accessing the NULL context, use clk_src->base.ctx->logger
+everywhere. That context in base is initialized earlier in
+dce110_clk_src_construct() and dce112_clk_src_construct(). Before
+get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions
+above are actually called. This is done by redefining DC_LOGGER to
+CTX->logger.
+
+Before:
+dce110_clk_src_construct() did:
+ -> sets clk_src->base.ctx = ctx;
+ -> ss_info_from_atombios_create()
+ -> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM
+ -> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx
+
+After:
+dce110_clk_src_construct() does:
+ -> sets clk_src->base.ctx = ctx;
+ -> ss_info_from_atombios_create()
+ -> get_ss_info_from_atombios() <- uses clk_src->base.ctx
+
+Closes: https://bugzilla.suse.com/show_bug.cgi?id=1271175
+Closes: https://lore.kernel.org/all/a9ee54e6-2413-4156-9bde-d528ae3c63a3@kernel.org/
+Fixes: 1296423bf23c ("drm/amd/display: define DC_LOGGER for logger")
+Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
+Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+Cc: Lakha, Bhawanpreet <Bhawanpreet.Lakha@amd.com>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Leo Li <sunpeng.li@amd.com>
+Cc: Rodrigo Siqueira <siqueira@igalia.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: "Christian König" <christian.koenig@amd.com>
+Cc: David Airlie <airlied@gmail.com>
+Cc: Simona Vetter <simona@ffwll.ch>
+Cc: amd-gfx@lists.freedesktop.org
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 ++++++++----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
+@@ -45,9 +45,7 @@
+ clk_src->base.ctx
+
+ #define DC_LOGGER \
+- calc_pll_cs->ctx->logger
+-#define DC_LOGGER_INIT() \
+- struct calc_pll_clock_source *calc_pll_cs = &clk_src->calc_pll
++ CTX->logger
+
+ #undef FN
+ #define FN(reg_name, field_name) \
+@@ -289,6 +287,7 @@ static bool calc_pll_dividers_in_range(
+ }
+
+ static uint32_t calculate_pixel_clock_pll_dividers(
++ struct dce110_clk_src *clk_src,
+ struct calc_pll_clock_source *calc_pll_cs,
+ struct pll_settings *pll_settings)
+ {
+@@ -477,7 +476,7 @@ static uint32_t dce110_get_pix_clk_divid
+ {
+ uint32_t field = 0;
+ uint32_t pll_calc_error = MAX_PLL_CALC_ERROR;
+- DC_LOGGER_INIT();
++
+ /* Check if reference clock is external (not pcie/xtalin)
+ * HW Dce80 spec:
+ * 00 - PCIE_REFCLK, 01 - XTALIN, 02 - GENERICA, 03 - GENERICB
+@@ -520,12 +519,14 @@ static uint32_t dce110_get_pix_clk_divid
+ /*Calculate Dividers by HDMI object, no SS case or SS case */
+ pll_calc_error =
+ calculate_pixel_clock_pll_dividers(
++ clk_src,
+ &clk_src->calc_pll_hdmi,
+ pll_settings);
+ else
+ /*Calculate Dividers by default object, no SS case or SS case */
+ pll_calc_error =
+ calculate_pixel_clock_pll_dividers(
++ clk_src,
+ &clk_src->calc_pll,
+ pll_settings);
+
+@@ -571,7 +572,6 @@ static uint32_t dce110_get_pix_clk_divid
+ {
+ struct dce110_clk_src *clk_src = TO_DCE110_CLK_SRC(cs);
+ uint32_t pll_calc_error = MAX_PLL_CALC_ERROR;
+- DC_LOGGER_INIT();
+
+ if (pix_clk_params == NULL || pll_settings == NULL
+ || pix_clk_params->requested_pix_clk_100hz == 0) {
+@@ -603,7 +603,6 @@ static uint32_t dce112_get_pix_clk_divid
+ struct pll_settings *pll_settings)
+ {
+ struct dce110_clk_src *clk_src = TO_DCE110_CLK_SRC(cs);
+- DC_LOGGER_INIT();
+
+ if (pix_clk_params == NULL || pll_settings == NULL
+ || pix_clk_params->requested_pix_clk_100hz == 0) {
+@@ -1372,8 +1371,6 @@ static uint32_t dcn3_get_pix_clk_divider
+ unsigned long long actual_pix_clk_100Hz = pix_clk_params ? pix_clk_params->requested_pix_clk_100hz : 0;
+ struct dce110_clk_src *clk_src = TO_DCE110_CLK_SRC(cs);
+
+- DC_LOGGER_INIT();
+-
+ if (pix_clk_params == NULL || pll_settings == NULL
+ || pix_clk_params->requested_pix_clk_100hz == 0) {
+ DC_LOG_ERROR(
+@@ -1443,7 +1440,6 @@ static const struct clock_source_funcs d
+ .get_pixel_clk_frequency_100hz = get_pixel_clk_frequency_100hz
+ };
+
+-
+ static void get_ss_info_from_atombios(
+ struct dce110_clk_src *clk_src,
+ enum as_signal_type as_signal,
+@@ -1456,7 +1452,7 @@ static void get_ss_info_from_atombios(
+ struct spread_spectrum_info *ss_info_cur;
+ struct spread_spectrum_data *ss_data_cur;
+ uint32_t i;
+- DC_LOGGER_INIT();
++
+ if (ss_entries_num == NULL) {
+ DC_LOG_SYNC(
+ "Invalid entry !!!\n");
+@@ -1587,6 +1583,7 @@ static void ss_info_from_atombios_create
+ }
+
+ static bool calc_pll_max_vco_construct(
++ struct dce110_clk_src *clk_src,
+ struct calc_pll_clock_source *calc_pll_cs,
+ struct calc_pll_clock_source_init_data *init_data)
+ {
+@@ -1738,6 +1735,7 @@ bool dce110_clk_src_construct(
+ ss_info_from_atombios_create(clk_src);
+
+ if (!calc_pll_max_vco_construct(
++ clk_src,
+ &clk_src->calc_pll,
+ &calc_pll_cs_init_data)) {
+ ASSERT_CRITICAL(false);
+@@ -1752,7 +1750,7 @@ bool dce110_clk_src_construct(
+
+
+ if (!calc_pll_max_vco_construct(
+- &clk_src->calc_pll_hdmi, &calc_pll_cs_init_data_hdmi)) {
++ clk_src, &clk_src->calc_pll_hdmi, &calc_pll_cs_init_data_hdmi)) {
+ ASSERT_CRITICAL(false);
+ goto unexpected_failure;
+ }
--- /dev/null
+From 99b2fe4f19e3be0a8d0a0b5ea98d855970889653 Mon Sep 17 00:00:00 2001
+From: Gang Ba <Gang.Ba@amd.com>
+Date: Tue, 14 Jul 2026 15:08:57 -0400
+Subject: drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
+
+From: Gang Ba <Gang.Ba@amd.com>
+
+commit 99b2fe4f19e3be0a8d0a0b5ea98d855970889653 upstream.
+
+Prevent unauthorized termination of active GPU debug sessions.
+Previously, users with /dev/kfd access could terminate another process's
+debug session without proper ownership or ptrace authorization.
+
+Signed-off-by: Gang Ba <Gang.Ba@amd.com>
+Reviewed-by: Kent Russell <kent.russell@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 4db4c5ffd5585b72622ecf6ffedf2da258ee23f5)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -3038,10 +3038,14 @@ static int kfd_ioctl_set_debug_trap(stru
+ goto out;
+ }
+
+- /* Check if target is still PTRACED. */
++ /*
++ * Verify debugger has permission to debug target process.
++ * For cross-process debugging, require active ptrace relationship.
++ * This applies to ALL operations to prevent unauthorized interference.
++ */
+ rcu_read_lock();
+- if (target != p && args->op != KFD_IOC_DBG_TRAP_DISABLE
+- && ptrace_parent(target->lead_thread) != current) {
++ if (target != p && ptrace_parent(target->lead_thread) != current
++ && target->debugger_process != p) {
+ pr_err("PID %i is not PTRACED and cannot be debugged\n", args->pid);
+ r = -EPERM;
+ }
--- /dev/null
+From 38b73293f38658a4685ffcea666462024f858ad9 Mon Sep 17 00:00:00 2001
+From: Vladimir Marioukhine <Vladimir.Marioukhine@amd.com>
+Date: Mon, 20 Jul 2026 11:53:30 -0400
+Subject: drm/amdkfd: fix QID bit leak in pqm_create_queue()
+
+From: Vladimir Marioukhine <Vladimir.Marioukhine@amd.com>
+
+commit 38b73293f38658a4685ffcea666462024f858ad9 upstream.
+
+When MES is enabled and amdgpu_amdkfd_alloc_kernel_mem() fails during
+the first queue creation for a process, pqm_create_queue() returns
+early via 'return retval' without going through the err_create_queue
+cleanup label.
+
+This means clear_bit(*qid, pqm->queue_slot_bitmap) is never called,
+leaving the reserved QID bit permanently set in queue_slot_bitmap.
+Over time this leaks QID slots, potentially exhausting all available
+queue slots.
+
+Fix this by replacing 'return retval' with 'goto err_allocate_pqn'
+so that clear_bit() is always called on the error path without
+touching the uninitialized pqn pointer.
+
+AILIKFD-813
+
+Reported-by: Deucher, Alexander <alexander.deucher@amd.com>
+Signed-off-by: Vladimir Marioukhine <Vladimir.Marioukhine@amd.com>
+Reviewed-by: Kent Russell <kent.russell@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit a107f74c38edbb80d6ab64dcaeeb292c14e9779f)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+@@ -378,7 +378,7 @@ int pqm_create_queue(struct process_queu
+ false);
+ if (retval) {
+ dev_err(dev->adev->dev, "failed to allocate process context bo\n");
+- return retval;
++ goto err_allocate_pqn;
+ }
+ memset(pdd->proc_ctx_cpu_ptr, 0, AMDGPU_MES_PROC_CTX_SIZE);
+ }
--- /dev/null
+From 83463a96ea3c7d8ae636a4d6a0ba63c9ce410724 Mon Sep 17 00:00:00 2001
+From: William Palacek <William.Palacek@amd.com>
+Date: Mon, 20 Jul 2026 12:51:34 -0400
+Subject: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
+
+From: William Palacek <William.Palacek@amd.com>
+
+commit 83463a96ea3c7d8ae636a4d6a0ba63c9ce410724 upstream.
+
+eop_ring_buffer_size in struct queue_properties is a u32. In
+kfd_queue_acquire_buffers() the expected EOP buffer size is computed as
+ALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the
+addition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to
+0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on
+size != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD
+cp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB
+BO, so CP EOP writes can land past the buffer and fault the GPU.
+
+Cast the operand to u64 so the alignment is computed in 64-bit; the size
+check in kfd_queue_buffer_get() then rejects the oversized request.
+
+Fixes: 42ea9cf2f16b ("drm/amdkfd: Relax size checking during queue buffer get")
+Signed-off-by: William Palacek <William.Palacek@amd.com>
+Reviewed-by: Alysa Liu <Alysa.Liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ae443117b742c357bfef3a7bddabf76fcf86e9ef)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+@@ -288,7 +288,7 @@ int kfd_queue_acquire_buffers(struct kfd
+ }
+ err = kfd_queue_buffer_get(vm, (void *)properties->eop_ring_buffer_address,
+ &properties->eop_buf_bo,
+- ALIGN(properties->eop_ring_buffer_size, PAGE_SIZE));
++ ALIGN((u64)properties->eop_ring_buffer_size, PAGE_SIZE));
+ if (err)
+ goto out_err_unreserve;
+ }
--- /dev/null
+From a9cdc85839e4fe2c760aa4ca6cc341c31ad1918a Mon Sep 17 00:00:00 2001
+From: David Francis <David.Francis@amd.com>
+Date: Tue, 21 Jul 2026 09:30:07 -0400
+Subject: drm/amdkfd: Handle invalid event type in CRIU event restore
+
+From: David Francis <David.Francis@amd.com>
+
+commit a9cdc85839e4fe2c760aa4ca6cc341c31ad1918a upstream.
+
+In kfd_criu_restore_event, there was no handling for
+the event priv data having an invalid event type. The priv
+data here is untrusted and can be invalid.
+
+In that case, fail with EINVAL.
+
+Signed-off-by: David Francis <David.Francis@amd.com>
+Reviewed-by: Kent Russell <kent.russell@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 2e8e9963cd5c41aa14fd5316bf9ec92e7a0e3097)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_events.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+@@ -524,6 +524,9 @@ int kfd_criu_restore_event(struct file *
+
+ ret = create_other_event(p, ev, &ev_priv->event_id);
+ break;
++ default:
++ ret = -EINVAL;
++ break;
+ }
+ mutex_unlock(&p->event_mutex);
+
--- /dev/null
+From ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2 Mon Sep 17 00:00:00 2001
+From: William Palacek <William.Palacek@amd.com>
+Date: Wed, 22 Jul 2026 11:20:56 -0400
+Subject: drm/amdkfd: hold event_mutex while checkpointing CRIU events
+
+From: William Palacek <William.Palacek@amd.com>
+
+commit ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2 upstream.
+
+kfd_criu_checkpoint_events() counts the entries in p->event_idr via
+kfd_get_num_events(), allocates an array sized to that count, and then
+walks the same IDR to fill it. Neither the count nor the walk holds
+p->event_mutex.
+
+The CRIU checkpoint caller holds only p->mutex. Event create and destroy
+(kfd_event_create()/kfd_event_destroy()) take p->event_mutex and do not
+take p->mutex, so a second thread in the same process can insert or remove
+events between the count and the walk. If an event is inserted, the walk
+iterates more entries than were counted and writes past the end of the
+ev_privs allocation; if an event is removed, the walk dereferences an
+entry that is being freed.
+
+Hold p->event_mutex across the count and the walk so both observe a
+consistent view of p->event_idr. The lock is released before
+copy_to_user(), which only touches the local buffer. The caller already
+holds p->mutex and the create/destroy paths never take p->mutex, so the
+p->mutex -> p->event_mutex order is not inverted and no deadlock is
+introduced.
+
+Fixes: 40e8a766a761 ("drm/amdkfd: CRIU checkpoint and restore events")
+Signed-off-by: William Palacek <William.Palacek@amd.com>
+Reviewed-by: Alysa Liu <Alysa.Liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ff57e223ab105795b05d3ef3f3c35a5a441bcbaa)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_events.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+@@ -548,15 +548,27 @@ int kfd_criu_checkpoint_events(struct kf
+ int ret = 0;
+ struct kfd_event *ev;
+ uint32_t ev_id;
++ uint32_t num_events;
+
+- uint32_t num_events = kfd_get_num_events(p);
+-
+- if (!num_events)
++ /* Serialize the count and the walk below against concurrent event
++ * create/destroy. Those paths take only p->event_mutex, not the
++ * p->mutex held by the CRIU checkpoint caller, so without this the
++ * event_idr can grow between kfd_get_num_events() and the loop and the
++ * walk writes past the ev_privs allocation.
++ */
++ mutex_lock(&p->event_mutex);
++
++ num_events = kfd_get_num_events(p);
++ if (!num_events) {
++ mutex_unlock(&p->event_mutex);
+ return 0;
++ }
+
+ ev_privs = kvzalloc(num_events * sizeof(*ev_privs), GFP_KERNEL);
+- if (!ev_privs)
++ if (!ev_privs) {
++ mutex_unlock(&p->event_mutex);
+ return -ENOMEM;
++ }
+
+
+ idr_for_each_entry(&p->event_idr, ev, ev_id) {
+@@ -597,6 +609,8 @@ int kfd_criu_checkpoint_events(struct kf
+ i++;
+ }
+
++ mutex_unlock(&p->event_mutex);
++
+ ret = copy_to_user(user_priv_data + *priv_data_offset,
+ ev_privs, num_events * sizeof(*ev_privs));
+ if (ret) {
drm-amd-pm-fix-pptable-use-after-free.patch
drm-amd-pm-hide-pp_table-sysfs-on-apus.patch
drm-amd-pm-use-milliwatts-for-gpu-power-sensors.patch
+drm-amd-display-check-if-dml21_add_phantom_plane-is-successful.patch
+drm-amd-display-fix-divide-by-zero-in-calculate_mcache_setting-on-zero-viewport.patch
+drm-amd-display-increase-hdmi-av-mute-wait-from-2-to-3-frames.patch
+drm-amd-display-silence-link_dpms-i2c-retimer-failures.patch
+drm-amd-display-use-proper-context-for-logging.patch
+drm-amdkfd-fix-missing-authorization-check-in-kfd_ioc_dbg_trap_disable.patch
+drm-amdkfd-fix-qid-bit-leak-in-pqm_create_queue.patch
+drm-amdkfd-fix-uint32_t-overflow-in-eop-ring-buffer-size-alignment.patch
+drm-amdkfd-handle-invalid-event-type-in-criu-event-restore.patch
+drm-amdkfd-hold-event_mutex-while-checkpointing-criu-events.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
