From: Greg Kroah-Hartman Date: Wed, 5 Aug 2026 12:14:21 +0000 (+0200) Subject: 7.1-stable patches X-Git-Tag: v5.10.263~27 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9d20a6e27b66ba2705f0c537361440eb7122a056;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: drm-amd-display-check-if-dml21_add_phantom_plane-is-successful.patch drm-amd-display-fix-divide-by-zero-in-calculate_mcache_setting-on-zero-viewport.patch drm-amd-display-increase-hdmi-av-mute-wait-from-2-to-3-frames.patch drm-amd-display-silence-link_dpms-i2c-retimer-failures.patch drm-amd-display-use-proper-context-for-logging.patch drm-amdkfd-fix-missing-authorization-check-in-kfd_ioc_dbg_trap_disable.patch drm-amdkfd-fix-qid-bit-leak-in-pqm_create_queue.patch drm-amdkfd-fix-uint32_t-overflow-in-eop-ring-buffer-size-alignment.patch drm-amdkfd-handle-invalid-event-type-in-criu-event-restore.patch drm-amdkfd-hold-event_mutex-while-checkpointing-criu-events.patch --- diff --git a/queue-7.1/drm-amd-display-check-if-dml21_add_phantom_plane-is-successful.patch b/queue-7.1/drm-amd-display-check-if-dml21_add_phantom_plane-is-successful.patch new file mode 100644 index 0000000000..b73415c1db --- /dev/null +++ b/queue-7.1/drm-amd-display-check-if-dml21_add_phantom_plane-is-successful.patch @@ -0,0 +1,49 @@ +From 000acb4ce7fb9feba3072ce468ad681f6585cd5d Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 16 Feb 2026 09:32:53 -0500 +Subject: drm/amd/display: check if dml21_add_phantom_plane() is successful + +From: Alex Deucher + +commit 000acb4ce7fb9feba3072ce468ad681f6585cd5d upstream. + +Verify that the phantom plane was allocated to avoid a later +segfault. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4970 +Fixes: 70839da63605 ("drm/amd/display: Add new DCN401 sources") +Reviewed-by: Dillon Varone +Signed-off-by: Fangzhi Zuo +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_utils.c | 15 ++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_utils.c ++++ b/drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_utils.c +@@ -359,14 +359,13 @@ void dml21_handle_phantom_streams_planes + main_plane = main_stream_status->plane_states[dc_plane_index]; + + /* create phantom planes for subvp enabled plane */ +- dml21_add_phantom_plane(dml_ctx, +- dc, +- context, +- phantom_stream, +- main_plane, +- &dml_ctx->v21.mode_programming.programming->plane_programming[dml_plane_index]); +- +- phantoms_added = true; ++ if (dml21_add_phantom_plane(dml_ctx, ++ dc, ++ context, ++ phantom_stream, ++ main_plane, ++ &dml_ctx->v21.mode_programming.programming->plane_programming[dml_plane_index])) ++ phantoms_added = true; + } + } + } diff --git a/queue-7.1/drm-amd-display-fix-divide-by-zero-in-calculate_mcache_setting-on-zero-viewport.patch b/queue-7.1/drm-amd-display-fix-divide-by-zero-in-calculate_mcache_setting-on-zero-viewport.patch new file mode 100644 index 0000000000..5b774281a5 --- /dev/null +++ b/queue-7.1/drm-amd-display-fix-divide-by-zero-in-calculate_mcache_setting-on-zero-viewport.patch @@ -0,0 +1,115 @@ +From f327e389c07cfc3a2f6ff54f6214e1a52d457edc Mon Sep 17 00:00:00 2001 +From: George Zhang +Date: Thu, 16 Jul 2026 17:00:01 -0400 +Subject: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport + +From: George Zhang + +commit f327e389c07cfc3a2f6ff54f6214e1a52d457edc upstream. + +If a plane reaches calculate_mcache_setting with a zero-area viewport, +calculate_mcache_setting exits early with num_mcaches == 0 and +mvmpg_width/height == 0. This will cause a divide-by-zero panic and can +also cause an underflow on num_mcaches. + +Fix this by changing calculate_mcache_setting to bool and adding guards +after each calculate_mcache_row_bytes call. If num_mcaches or +mvmpg_width/height is zero, return a false. Callers will propagate the +failure as a rejected mode, which prevents the panic. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5302 +Reviewed-by: Sun peng (Leo) Li +Reviewed-by: Dillon Varone +Signed-off-by: George Zhang +Signed-off-by: Fangzhi Zuo +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 29c0f7c655f47bcbd575ff75e58480df6ec3c9da) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 31 ++++++++-- + 1 file changed, 25 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_core/dml2_core_dcn4_calcs.c ++++ b/drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_core/dml2_core_dcn4_calcs.c +@@ -2425,7 +2425,7 @@ static void calculate_mcache_row_bytes( + DML_ASSERT(*p->num_mcaches > 0); + } + +-static void calculate_mcache_setting( ++static bool calculate_mcache_setting( + struct dml2_core_internal_scratch *scratch, + struct dml2_core_calcs_calculate_mcache_setting_params *p) + { +@@ -2451,7 +2451,7 @@ static void calculate_mcache_setting( + *p->lc_comb_mcache = 0; + + if (!p->dcc_enable) +- return; ++ return true; + + l->is_dual_plane = dml_is_420(p->source_format) || p->source_format == dml2_rgbe_alpha; + +@@ -2488,7 +2488,14 @@ static void calculate_mcache_setting( + l->l_p.mvmpg_per_mcache_lb = &l->mvmpg_per_mcache_lb_l; + + calculate_mcache_row_bytes(scratch, &l->l_p); +- DML_ASSERT(*p->num_mcaches_l > 0); ++ if (*p->num_mcaches_l == 0 || ++ (p->surf_vert ? l->mvmpg_height_l : l->mvmpg_width_l) == 0) { ++ DML_LOG_VERBOSE("DML::%s: degenerate luma viewport (num_mcaches_l=%u mvmpg_%s_l=%u) — mode not supported\n", ++ __func__, *p->num_mcaches_l, ++ p->surf_vert ? "height" : "width", ++ p->surf_vert ? l->mvmpg_height_l : l->mvmpg_width_l); ++ return false; ++ } + + if (l->is_dual_plane) { + l->c_p.num_chans = p->num_chans; +@@ -2524,7 +2531,14 @@ static void calculate_mcache_setting( + l->c_p.mvmpg_per_mcache_lb = &l->mvmpg_per_mcache_lb_c; + + calculate_mcache_row_bytes(scratch, &l->c_p); +- DML_ASSERT(*p->num_mcaches_c > 0); ++ if (*p->num_mcaches_c == 0 || ++ (p->surf_vert ? l->mvmpg_height_c : l->mvmpg_width_c) == 0) { ++ DML_LOG_VERBOSE("DML::%s: degenerate chroma viewport (num_mcaches_c=%u mvmpg_%s_c=%u) — mode not supported\n", ++ __func__, *p->num_mcaches_c, ++ p->surf_vert ? "height" : "width", ++ p->surf_vert ? l->mvmpg_height_c : l->mvmpg_width_c); ++ return false; ++ } + } + + // Sharing for iMALL access +@@ -2634,6 +2648,7 @@ static void calculate_mcache_setting( + + *p->mcache_shift_granularity_l = l->mvmpg_access_width_l; + *p->mcache_shift_granularity_c = l->mvmpg_access_width_c; ++ return true; + } + + static void calculate_mall_bw_overhead_factor( +@@ -9430,7 +9445,10 @@ static bool dml_core_mode_support(struct + calculate_mcache_setting_params->mall_comb_mcache_c = &mode_lib->ms.mall_comb_mcache_c[k]; + calculate_mcache_setting_params->lc_comb_mcache = &mode_lib->ms.lc_comb_mcache[k]; + +- calculate_mcache_setting(&mode_lib->scratch, calculate_mcache_setting_params); ++ if (!calculate_mcache_setting(&mode_lib->scratch, calculate_mcache_setting_params)) { ++ mode_lib->ms.support.ModeSupport = false; ++ return false; ++ } + } + + calculate_mall_bw_overhead_factor( +@@ -10906,7 +10924,8 @@ static bool dml_core_mode_programming(st + calculate_mcache_setting_params->mall_comb_mcache_l = &mode_lib->mp.mall_comb_mcache_l[k]; + calculate_mcache_setting_params->mall_comb_mcache_c = &mode_lib->mp.mall_comb_mcache_c[k]; + calculate_mcache_setting_params->lc_comb_mcache = &mode_lib->mp.lc_comb_mcache[k]; +- calculate_mcache_setting(&mode_lib->scratch, calculate_mcache_setting_params); ++ if (!calculate_mcache_setting(&mode_lib->scratch, calculate_mcache_setting_params)) ++ return false; + } + + calculate_mall_bw_overhead_factor( diff --git a/queue-7.1/drm-amd-display-increase-hdmi-av-mute-wait-from-2-to-3-frames.patch b/queue-7.1/drm-amd-display-increase-hdmi-av-mute-wait-from-2-to-3-frames.patch new file mode 100644 index 0000000000..e39f020a0d --- /dev/null +++ b/queue-7.1/drm-amd-display-increase-hdmi-av-mute-wait-from-2-to-3-frames.patch @@ -0,0 +1,58 @@ +From c216b39fbbc4b007fd6984cffd85039d49a55154 Mon Sep 17 00:00:00 2001 +From: Ray Wu +Date: Fri, 3 Jul 2026 09:14:49 +0800 +Subject: drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames + +From: Ray Wu + +commit c216b39fbbc4b007fd6984cffd85039d49a55154 upstream. + +Some HDMI sinks need additional GCP packets to properly process the +mute state before the timing generator is disabled, especially after +link re-establishment with HDMI 2.0 scrambling enabled. Waiting for +only 2 frames is insufficient for certain monitor firmware, resulting +in garbled display output on resume from suspend. + +Increase the AV mute wait in dcn30_set_avmute() from 2 to 3 frames +to ensure the sink receives enough GCP packets. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5167 +Assisted-by: Cursor:Claude-Opus-4.6 +Reviewed-by: Wayne Lin +Signed-off-by: Ray Wu +Tested-by: Dan Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 0c0d5174b09640d8b560764aa5a177630e076e93) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c +@@ -841,13 +841,19 @@ void dcn30_set_avmute(struct pipe_ctx *p + pipe_ctx->stream_res.stream_enc, + enable); + +- /* Wait for two frame to make sure AV mute is sent out */ ++ /* Wait for three frames to make sure AV mute is sent out. ++ * Some HDMI sinks need additional GCP packets to properly ++ * process the mute state, especially after link re-establishment ++ * with HDMI 2.0 scrambling enabled. ++ */ + if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) { ++ int i; ++ + pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); +- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK); +- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); +- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK); +- pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ for (i = 0; i < 3; i++) { ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK); ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ } + } + } + } diff --git a/queue-7.1/drm-amd-display-silence-link_dpms-i2c-retimer-failures.patch b/queue-7.1/drm-amd-display-silence-link_dpms-i2c-retimer-failures.patch new file mode 100644 index 0000000000..406d7cc4de --- /dev/null +++ b/queue-7.1/drm-amd-display-silence-link_dpms-i2c-retimer-failures.patch @@ -0,0 +1,99 @@ +From 8ccb87b1c9be594fc2c36b0a4006a66f08dee1c8 Mon Sep 17 00:00:00 2001 +From: Alan Swanson +Date: Mon, 27 Jul 2026 17:01:26 +0100 +Subject: drm/amd/display: Silence link_dpms I2C retimer failures + +From: Alan Swanson + +commit 8ccb87b1c9be594fc2c36b0a4006a66f08dee1c8 upstream. + +Commit a4f01bf729b2 ("drm/amd/display: Refactor and fix link_dpms I2C") +had also changed the "Set retimer failed" messages from DC_LOG_DEBUG() +to DC_LOG_ERROR(). This unfortunately can create log spam. + +Change those back to DC_LOG_DEBUG() only. + +Fixes: a4f01bf729b2 ("drm/amd/display: Refactor and fix link_dpms I2C") +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5520 +Signed-off-by: Alan Swanson +Signed-off-by: Alex Deucher +(cherry picked from commit da8609eef18b0a3490d0e1fa9440659fadc8194d) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c ++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c +@@ -379,7 +379,7 @@ static bool write_i2c_retimer_vga( + + for (size_t i = 0; i < ARRAY_SIZE(vga_data); i++) { + if (!write_i2c_retimer_offset_value(link, address, vga_data[i][0], vga_data[i][1])) { +- DC_LOG_ERROR("Set retimer failed, vga index: %zu\n", i); ++ DC_LOG_DEBUG("Set retimer failed, vga index: %zu\n", i); + return false; + } + } +@@ -400,7 +400,7 @@ static bool write_i2c_retimer_byte( + return true; + + if (!write_i2c_retimer_offset_value(link, address, index, value)) { +- DC_LOG_ERROR("Set retimer failed, 3g index: 0x%x, value: 0x%x\n", index, value); ++ DC_LOG_DEBUG("Set retimer failed, 3g index: 0x%x, value: 0x%x\n", index, value); + return false; + } + +@@ -416,14 +416,14 @@ static bool write_i2c_retimer_byte( + if (!link_query_ddc_data( + link->ddc, address, &offset, 1, &value, 1 + )) { +- DC_LOG_ERROR("Set retimer failed, link_query_ddc_data\n"); ++ DC_LOG_DEBUG("Set retimer failed, link_query_ddc_data\n"); + return false; + } + } + + value |= apply_rx_tx_change; + if (!write_i2c_retimer_offset_value(link, address, offset, value)) { +- DC_LOG_ERROR("Set retimer failed, 3g offset: 0x%x, value: 0x%x\n", offset, value); ++ DC_LOG_DEBUG("Set retimer failed, 3g offset: 0x%x, value: 0x%x\n", offset, value); + return false; + } + } +@@ -444,7 +444,7 @@ static bool write_i2c_retimer_setting( + uint8_t value = settings->reg_settings[i].i2c_reg_val; + + if (!write_i2c_retimer_byte(link, address, index, value)) { +- DC_LOG_ERROR("Set retimer failed, index: %zu\n", i); ++ DC_LOG_DEBUG("Set retimer failed, index: %zu\n", i); + return false; + } + } +@@ -455,7 +455,7 @@ static bool write_i2c_retimer_setting( + uint8_t value = settings->reg_settings_6g[i].i2c_reg_val; + + if (!write_i2c_retimer_byte(link, address, index, value)) { +- DC_LOG_ERROR("Set retimer failed, 6g index: %zu\n", i); ++ DC_LOG_DEBUG("Set retimer failed, 6g index: %zu\n", i); + return false; + } + } +@@ -487,7 +487,7 @@ static bool write_i2c_default_retimer_se + + for (size_t i = 0; i < ARRAY_SIZE(data); i++) { + if (!write_i2c_retimer_offset_value(link, address, data[i][0], data[i][1])) { +- DC_LOG_ERROR("Set default retimer failed, index: %zu\n", i); ++ DC_LOG_DEBUG("Set default retimer failed, index: %zu\n", i); + return false; + } + } +@@ -519,7 +519,7 @@ static bool write_i2c_redriver_setting( + ); + + if (!success) +- DC_LOG_ERROR("Set redriver failed"); ++ DC_LOG_DEBUG("Set redriver failed"); + return success; + } + diff --git a/queue-7.1/drm-amd-display-use-proper-context-for-logging.patch b/queue-7.1/drm-amd-display-use-proper-context-for-logging.patch new file mode 100644 index 0000000000..b2a507ad39 --- /dev/null +++ b/queue-7.1/drm-amd-display-use-proper-context-for-logging.patch @@ -0,0 +1,175 @@ +From 114b42507b6a23d9d24e24e4ef165233332c64d4 Mon Sep 17 00:00:00 2001 +From: "Jiri Slaby (SUSE)" +Date: Thu, 23 Jul 2026 06:25:48 +0200 +Subject: drm/amd/display: use proper context for logging +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jiri Slaby (SUSE) + +commit 114b42507b6a23d9d24e24e4ef165233332c64d4 upstream. + +The same as the rest of the code, get_ss_info_from_atombios() uses +calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is +initialized only later in calc_pll_max_vco_construct(). Therefore, any +output using DC_LOG_SYNC() leads to a NULL pointer deference in +get_ss_info_from_atombios(). + +According to Sashiko, the very same problem exists in +dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too. + +To avoid accessing the NULL context, use clk_src->base.ctx->logger +everywhere. That context in base is initialized earlier in +dce110_clk_src_construct() and dce112_clk_src_construct(). Before +get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions +above are actually called. This is done by redefining DC_LOGGER to +CTX->logger. + +Before: +dce110_clk_src_construct() did: + -> sets clk_src->base.ctx = ctx; + -> ss_info_from_atombios_create() + -> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM + -> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx + +After: +dce110_clk_src_construct() does: + -> sets clk_src->base.ctx = ctx; + -> ss_info_from_atombios_create() + -> get_ss_info_from_atombios() <- uses clk_src->base.ctx + +Closes: https://bugzilla.suse.com/show_bug.cgi?id=1271175 +Closes: https://lore.kernel.org/all/a9ee54e6-2413-4156-9bde-d528ae3c63a3@kernel.org/ +Fixes: 1296423bf23c ("drm/amd/display: define DC_LOGGER for logger") +Reviewed-by: Bhawanpreet Lakha +Signed-off-by: Jiri Slaby (SUSE) +Cc: Lakha, Bhawanpreet +Cc: Harry Wentland +Cc: Leo Li +Cc: Rodrigo Siqueira +Cc: Alex Deucher +Cc: "Christian König" +Cc: David Airlie +Cc: Simona Vetter +Cc: amd-gfx@lists.freedesktop.org +Signed-off-by: Alex Deucher +(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c | 20 ++++++++---------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c +@@ -45,9 +45,7 @@ + clk_src->base.ctx + + #define DC_LOGGER \ +- calc_pll_cs->ctx->logger +-#define DC_LOGGER_INIT() \ +- struct calc_pll_clock_source *calc_pll_cs = &clk_src->calc_pll ++ CTX->logger + + #undef FN + #define FN(reg_name, field_name) \ +@@ -289,6 +287,7 @@ static bool calc_pll_dividers_in_range( + } + + static uint32_t calculate_pixel_clock_pll_dividers( ++ struct dce110_clk_src *clk_src, + struct calc_pll_clock_source *calc_pll_cs, + struct pll_settings *pll_settings) + { +@@ -477,7 +476,7 @@ static uint32_t dce110_get_pix_clk_divid + { + uint32_t field = 0; + uint32_t pll_calc_error = MAX_PLL_CALC_ERROR; +- DC_LOGGER_INIT(); ++ + /* Check if reference clock is external (not pcie/xtalin) + * HW Dce80 spec: + * 00 - PCIE_REFCLK, 01 - XTALIN, 02 - GENERICA, 03 - GENERICB +@@ -520,12 +519,14 @@ static uint32_t dce110_get_pix_clk_divid + /*Calculate Dividers by HDMI object, no SS case or SS case */ + pll_calc_error = + calculate_pixel_clock_pll_dividers( ++ clk_src, + &clk_src->calc_pll_hdmi, + pll_settings); + else + /*Calculate Dividers by default object, no SS case or SS case */ + pll_calc_error = + calculate_pixel_clock_pll_dividers( ++ clk_src, + &clk_src->calc_pll, + pll_settings); + +@@ -571,7 +572,6 @@ static uint32_t dce110_get_pix_clk_divid + { + struct dce110_clk_src *clk_src = TO_DCE110_CLK_SRC(cs); + uint32_t pll_calc_error = MAX_PLL_CALC_ERROR; +- DC_LOGGER_INIT(); + + if (pix_clk_params == NULL || pll_settings == NULL + || pix_clk_params->requested_pix_clk_100hz == 0) { +@@ -603,7 +603,6 @@ static uint32_t dce112_get_pix_clk_divid + struct pll_settings *pll_settings) + { + struct dce110_clk_src *clk_src = TO_DCE110_CLK_SRC(cs); +- DC_LOGGER_INIT(); + + if (pix_clk_params == NULL || pll_settings == NULL + || pix_clk_params->requested_pix_clk_100hz == 0) { +@@ -1372,8 +1371,6 @@ static uint32_t dcn3_get_pix_clk_divider + unsigned long long actual_pix_clk_100Hz = pix_clk_params ? pix_clk_params->requested_pix_clk_100hz : 0; + struct dce110_clk_src *clk_src = TO_DCE110_CLK_SRC(cs); + +- DC_LOGGER_INIT(); +- + if (pix_clk_params == NULL || pll_settings == NULL + || pix_clk_params->requested_pix_clk_100hz == 0) { + DC_LOG_ERROR( +@@ -1443,7 +1440,6 @@ static const struct clock_source_funcs d + .get_pixel_clk_frequency_100hz = get_pixel_clk_frequency_100hz + }; + +- + static void get_ss_info_from_atombios( + struct dce110_clk_src *clk_src, + enum as_signal_type as_signal, +@@ -1456,7 +1452,7 @@ static void get_ss_info_from_atombios( + struct spread_spectrum_info *ss_info_cur; + struct spread_spectrum_data *ss_data_cur; + uint32_t i; +- DC_LOGGER_INIT(); ++ + if (ss_entries_num == NULL) { + DC_LOG_SYNC( + "Invalid entry !!!\n"); +@@ -1587,6 +1583,7 @@ static void ss_info_from_atombios_create + } + + static bool calc_pll_max_vco_construct( ++ struct dce110_clk_src *clk_src, + struct calc_pll_clock_source *calc_pll_cs, + struct calc_pll_clock_source_init_data *init_data) + { +@@ -1738,6 +1735,7 @@ bool dce110_clk_src_construct( + ss_info_from_atombios_create(clk_src); + + if (!calc_pll_max_vco_construct( ++ clk_src, + &clk_src->calc_pll, + &calc_pll_cs_init_data)) { + ASSERT_CRITICAL(false); +@@ -1752,7 +1750,7 @@ bool dce110_clk_src_construct( + + + if (!calc_pll_max_vco_construct( +- &clk_src->calc_pll_hdmi, &calc_pll_cs_init_data_hdmi)) { ++ clk_src, &clk_src->calc_pll_hdmi, &calc_pll_cs_init_data_hdmi)) { + ASSERT_CRITICAL(false); + goto unexpected_failure; + } diff --git a/queue-7.1/drm-amdkfd-fix-missing-authorization-check-in-kfd_ioc_dbg_trap_disable.patch b/queue-7.1/drm-amdkfd-fix-missing-authorization-check-in-kfd_ioc_dbg_trap_disable.patch new file mode 100644 index 0000000000..90631a21da --- /dev/null +++ b/queue-7.1/drm-amdkfd-fix-missing-authorization-check-in-kfd_ioc_dbg_trap_disable.patch @@ -0,0 +1,43 @@ +From 99b2fe4f19e3be0a8d0a0b5ea98d855970889653 Mon Sep 17 00:00:00 2001 +From: Gang Ba +Date: Tue, 14 Jul 2026 15:08:57 -0400 +Subject: drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE + +From: Gang Ba + +commit 99b2fe4f19e3be0a8d0a0b5ea98d855970889653 upstream. + +Prevent unauthorized termination of active GPU debug sessions. +Previously, users with /dev/kfd access could terminate another process's +debug session without proper ownership or ptrace authorization. + +Signed-off-by: Gang Ba +Reviewed-by: Kent Russell +Signed-off-by: Alex Deucher +(cherry picked from commit 4db4c5ffd5585b72622ecf6ffedf2da258ee23f5) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +@@ -3038,10 +3038,14 @@ static int kfd_ioctl_set_debug_trap(stru + goto out; + } + +- /* Check if target is still PTRACED. */ ++ /* ++ * Verify debugger has permission to debug target process. ++ * For cross-process debugging, require active ptrace relationship. ++ * This applies to ALL operations to prevent unauthorized interference. ++ */ + rcu_read_lock(); +- if (target != p && args->op != KFD_IOC_DBG_TRAP_DISABLE +- && ptrace_parent(target->lead_thread) != current) { ++ if (target != p && ptrace_parent(target->lead_thread) != current ++ && target->debugger_process != p) { + pr_err("PID %i is not PTRACED and cannot be debugged\n", args->pid); + r = -EPERM; + } diff --git a/queue-7.1/drm-amdkfd-fix-qid-bit-leak-in-pqm_create_queue.patch b/queue-7.1/drm-amdkfd-fix-qid-bit-leak-in-pqm_create_queue.patch new file mode 100644 index 0000000000..750c70981c --- /dev/null +++ b/queue-7.1/drm-amdkfd-fix-qid-bit-leak-in-pqm_create_queue.patch @@ -0,0 +1,47 @@ +From 38b73293f38658a4685ffcea666462024f858ad9 Mon Sep 17 00:00:00 2001 +From: Vladimir Marioukhine +Date: Mon, 20 Jul 2026 11:53:30 -0400 +Subject: drm/amdkfd: fix QID bit leak in pqm_create_queue() + +From: Vladimir Marioukhine + +commit 38b73293f38658a4685ffcea666462024f858ad9 upstream. + +When MES is enabled and amdgpu_amdkfd_alloc_kernel_mem() fails during +the first queue creation for a process, pqm_create_queue() returns +early via 'return retval' without going through the err_create_queue +cleanup label. + +This means clear_bit(*qid, pqm->queue_slot_bitmap) is never called, +leaving the reserved QID bit permanently set in queue_slot_bitmap. +Over time this leaks QID slots, potentially exhausting all available +queue slots. + +Fix this by replacing 'return retval' with 'goto err_allocate_pqn' +so that clear_bit() is always called on the error path without +touching the uninitialized pqn pointer. + +AILIKFD-813 + +Reported-by: Deucher, Alexander +Signed-off-by: Vladimir Marioukhine +Reviewed-by: Kent Russell +Signed-off-by: Alex Deucher +(cherry picked from commit a107f74c38edbb80d6ab64dcaeeb292c14e9779f) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +@@ -378,7 +378,7 @@ int pqm_create_queue(struct process_queu + false); + if (retval) { + dev_err(dev->adev->dev, "failed to allocate process context bo\n"); +- return retval; ++ goto err_allocate_pqn; + } + memset(pdd->proc_ctx_cpu_ptr, 0, AMDGPU_MES_PROC_CTX_SIZE); + } diff --git a/queue-7.1/drm-amdkfd-fix-uint32_t-overflow-in-eop-ring-buffer-size-alignment.patch b/queue-7.1/drm-amdkfd-fix-uint32_t-overflow-in-eop-ring-buffer-size-alignment.patch new file mode 100644 index 0000000000..0255558266 --- /dev/null +++ b/queue-7.1/drm-amdkfd-fix-uint32_t-overflow-in-eop-ring-buffer-size-alignment.patch @@ -0,0 +1,43 @@ +From 83463a96ea3c7d8ae636a4d6a0ba63c9ce410724 Mon Sep 17 00:00:00 2001 +From: William Palacek +Date: Mon, 20 Jul 2026 12:51:34 -0400 +Subject: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment + +From: William Palacek + +commit 83463a96ea3c7d8ae636a4d6a0ba63c9ce410724 upstream. + +eop_ring_buffer_size in struct queue_properties is a u32. In +kfd_queue_acquire_buffers() the expected EOP buffer size is computed as +ALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the +addition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to +0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on +size != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD +cp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB +BO, so CP EOP writes can land past the buffer and fault the GPU. + +Cast the operand to u64 so the alignment is computed in 64-bit; the size +check in kfd_queue_buffer_get() then rejects the oversized request. + +Fixes: 42ea9cf2f16b ("drm/amdkfd: Relax size checking during queue buffer get") +Signed-off-by: William Palacek +Reviewed-by: Alysa Liu +Signed-off-by: Alex Deucher +(cherry picked from commit ae443117b742c357bfef3a7bddabf76fcf86e9ef) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c +@@ -288,7 +288,7 @@ int kfd_queue_acquire_buffers(struct kfd + } + err = kfd_queue_buffer_get(vm, (void *)properties->eop_ring_buffer_address, + &properties->eop_buf_bo, +- ALIGN(properties->eop_ring_buffer_size, PAGE_SIZE)); ++ ALIGN((u64)properties->eop_ring_buffer_size, PAGE_SIZE)); + if (err) + goto out_err_unreserve; + } diff --git a/queue-7.1/drm-amdkfd-handle-invalid-event-type-in-criu-event-restore.patch b/queue-7.1/drm-amdkfd-handle-invalid-event-type-in-criu-event-restore.patch new file mode 100644 index 0000000000..d3b20495be --- /dev/null +++ b/queue-7.1/drm-amdkfd-handle-invalid-event-type-in-criu-event-restore.patch @@ -0,0 +1,37 @@ +From a9cdc85839e4fe2c760aa4ca6cc341c31ad1918a Mon Sep 17 00:00:00 2001 +From: David Francis +Date: Tue, 21 Jul 2026 09:30:07 -0400 +Subject: drm/amdkfd: Handle invalid event type in CRIU event restore + +From: David Francis + +commit a9cdc85839e4fe2c760aa4ca6cc341c31ad1918a upstream. + +In kfd_criu_restore_event, there was no handling for +the event priv data having an invalid event type. The priv +data here is untrusted and can be invalid. + +In that case, fail with EINVAL. + +Signed-off-by: David Francis +Reviewed-by: Kent Russell +Signed-off-by: Alex Deucher +(cherry picked from commit 2e8e9963cd5c41aa14fd5316bf9ec92e7a0e3097) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_events.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c +@@ -524,6 +524,9 @@ int kfd_criu_restore_event(struct file * + + ret = create_other_event(p, ev, &ev_priv->event_id); + break; ++ default: ++ ret = -EINVAL; ++ break; + } + mutex_unlock(&p->event_mutex); + diff --git a/queue-7.1/drm-amdkfd-hold-event_mutex-while-checkpointing-criu-events.patch b/queue-7.1/drm-amdkfd-hold-event_mutex-while-checkpointing-criu-events.patch new file mode 100644 index 0000000000..15d83d4cd1 --- /dev/null +++ b/queue-7.1/drm-amdkfd-hold-event_mutex-while-checkpointing-criu-events.patch @@ -0,0 +1,83 @@ +From ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2 Mon Sep 17 00:00:00 2001 +From: William Palacek +Date: Wed, 22 Jul 2026 11:20:56 -0400 +Subject: drm/amdkfd: hold event_mutex while checkpointing CRIU events + +From: William Palacek + +commit ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2 upstream. + +kfd_criu_checkpoint_events() counts the entries in p->event_idr via +kfd_get_num_events(), allocates an array sized to that count, and then +walks the same IDR to fill it. Neither the count nor the walk holds +p->event_mutex. + +The CRIU checkpoint caller holds only p->mutex. Event create and destroy +(kfd_event_create()/kfd_event_destroy()) take p->event_mutex and do not +take p->mutex, so a second thread in the same process can insert or remove +events between the count and the walk. If an event is inserted, the walk +iterates more entries than were counted and writes past the end of the +ev_privs allocation; if an event is removed, the walk dereferences an +entry that is being freed. + +Hold p->event_mutex across the count and the walk so both observe a +consistent view of p->event_idr. The lock is released before +copy_to_user(), which only touches the local buffer. The caller already +holds p->mutex and the create/destroy paths never take p->mutex, so the +p->mutex -> p->event_mutex order is not inverted and no deadlock is +introduced. + +Fixes: 40e8a766a761 ("drm/amdkfd: CRIU checkpoint and restore events") +Signed-off-by: William Palacek +Reviewed-by: Alysa Liu +Signed-off-by: Alex Deucher +(cherry picked from commit ff57e223ab105795b05d3ef3f3c35a5a441bcbaa) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_events.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c +@@ -548,15 +548,27 @@ int kfd_criu_checkpoint_events(struct kf + int ret = 0; + struct kfd_event *ev; + uint32_t ev_id; ++ uint32_t num_events; + +- uint32_t num_events = kfd_get_num_events(p); +- +- if (!num_events) ++ /* Serialize the count and the walk below against concurrent event ++ * create/destroy. Those paths take only p->event_mutex, not the ++ * p->mutex held by the CRIU checkpoint caller, so without this the ++ * event_idr can grow between kfd_get_num_events() and the loop and the ++ * walk writes past the ev_privs allocation. ++ */ ++ mutex_lock(&p->event_mutex); ++ ++ num_events = kfd_get_num_events(p); ++ if (!num_events) { ++ mutex_unlock(&p->event_mutex); + return 0; ++ } + + ev_privs = kvzalloc(num_events * sizeof(*ev_privs), GFP_KERNEL); +- if (!ev_privs) ++ if (!ev_privs) { ++ mutex_unlock(&p->event_mutex); + return -ENOMEM; ++ } + + + idr_for_each_entry(&p->event_idr, ev, ev_id) { +@@ -597,6 +609,8 @@ int kfd_criu_checkpoint_events(struct kf + i++; + } + ++ mutex_unlock(&p->event_mutex); ++ + ret = copy_to_user(user_priv_data + *priv_data_offset, + ev_privs, num_events * sizeof(*ev_privs)); + if (ret) { diff --git a/queue-7.1/series b/queue-7.1/series index e4581559c8..fdaae55244 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -395,3 +395,13 @@ drm-amd-pm-fix-torn-gpu-metrics-reads.patch drm-amd-pm-fix-pptable-use-after-free.patch drm-amd-pm-hide-pp_table-sysfs-on-apus.patch drm-amd-pm-use-milliwatts-for-gpu-power-sensors.patch +drm-amd-display-check-if-dml21_add_phantom_plane-is-successful.patch +drm-amd-display-fix-divide-by-zero-in-calculate_mcache_setting-on-zero-viewport.patch +drm-amd-display-increase-hdmi-av-mute-wait-from-2-to-3-frames.patch +drm-amd-display-silence-link_dpms-i2c-retimer-failures.patch +drm-amd-display-use-proper-context-for-logging.patch +drm-amdkfd-fix-missing-authorization-check-in-kfd_ioc_dbg_trap_disable.patch +drm-amdkfd-fix-qid-bit-leak-in-pqm_create_queue.patch +drm-amdkfd-fix-uint32_t-overflow-in-eop-ring-buffer-size-alignment.patch +drm-amdkfd-handle-invalid-event-type-in-criu-event-restore.patch +drm-amdkfd-hold-event_mutex-while-checkpointing-criu-events.patch