--- /dev/null
+From a6e14b976be48eebd8769cb5b883a6af7fc5ade1 Mon Sep 17 00:00:00 2001
+From: WenTao Liang <vulab@iscas.ac.cn>
+Date: Fri, 26 Jun 2026 20:45:55 +0800
+Subject: drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference
+
+From: WenTao Liang <vulab@iscas.ac.cn>
+
+commit a6e14b976be48eebd8769cb5b883a6af7fc5ade1 upstream.
+
+prev_sink is unconditionally retained via dc_sink_retain at function
+ entry, but the DP alt mode timeout path inside SIGNAL_TYPE_DISPLAY_PORT
+ returns false without releasing prev_sink. All other return paths in the
+ function correctly call dc_sink_release(prev_sink), making this the only
+ missing cleanup.
+
+Fixes: 54618888d1ea ("drm/amd/display: break down dc_link.c")
+Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20260626124555.36910-1-vulab@iscas.ac.cn
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 45510cf662dcf46b5d8926d454f338809f107b9d)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/link/link_detection.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
+@@ -1069,8 +1069,11 @@ static bool detect_link_and_local_sink(s
+ link->link_enc->features.flags.bits.DP_IS_USB_C == 1) {
+
+ /* if alt mode times out, return false */
+- if (!wait_for_entering_dp_alt_mode(link))
++ if (!wait_for_entering_dp_alt_mode(link)) {
++ if (prev_sink)
++ dc_sink_release(prev_sink);
+ return false;
++ }
+ }
+
+ if (!detect_dp(link, &sink_caps, reason)) {
--- /dev/null
+From ac11060c6d4959e2d4ceada037d2e1e1bfcf6645 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Wed, 10 Jun 2026 17:18:17 +0200
+Subject: drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit ac11060c6d4959e2d4ceada037d2e1e1bfcf6645 upstream.
+
+The mode-setting pipeline can disabled damage clippings for a commit
+by setting ignore_damage_clips in struct drm_plane_state. The commit
+will then do a full display update.
+
+Test the flag in DCN code and do a full update in DCN code if it has
+been set.
+
+Commit 35ed38d58257 ("drm: Allow drivers to indicate the damage helpers
+to ignore damage clips") introduced ignore_damage_clips to selectively
+ignore damage clipping in certain framebuffer changes. This driver does
+not do that, but DRM's damage iterator will soon rely on the flag.
+Therefore supporting it here as well make sense for consistency.
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: 35ed38d58257 ("drm: Allow drivers to indicate the damage helpers to ignore damage clips")
+Cc: Javier Martinez Canillas <javierm@redhat.com>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Zack Rusin <zackr@vmware.com>
+Cc: dri-devel@lists.freedesktop.org
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit a24019f6480fad5c077b5956eed942c8960323d6)
+Cc: <stable@vger.kernel.org> # v6.8+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -6440,8 +6440,8 @@ static void fill_dc_dirty_rects(struct d
+ {
+ struct dm_crtc_state *dm_crtc_state = to_dm_crtc_state(crtc_state);
+ struct rect *dirty_rects = flip_addrs->dirty_rects;
+- u32 num_clips;
+- struct drm_mode_rect *clips;
++ u32 num_clips = 0;
++ struct drm_mode_rect *clips = NULL;
+ bool bb_changed;
+ bool fb_changed;
+ u32 i = 0;
+@@ -6457,8 +6457,10 @@ static void fill_dc_dirty_rects(struct d
+ if (new_plane_state->rotation != DRM_MODE_ROTATE_0)
+ goto ffu;
+
+- num_clips = drm_plane_get_damage_clips_count(new_plane_state);
+- clips = drm_plane_get_damage_clips(new_plane_state);
++ if (!new_plane_state->ignore_damage_clips) {
++ num_clips = drm_plane_get_damage_clips_count(new_plane_state);
++ clips = drm_plane_get_damage_clips(new_plane_state);
++ }
+
+ if (num_clips && (!amdgpu_damage_clips || (amdgpu_damage_clips < 0 &&
+ is_psr_su)))
--- /dev/null
+From da353a6b30086674c77bdbbfd86e9e0c7416ba99 Mon Sep 17 00:00:00 2001
+From: Leorize <leorize+oss@disroot.org>
+Date: Mon, 18 May 2026 20:06:19 -0700
+Subject: drm/amd/display: set MSA MISC1 bit 6 when using VSC SDP for DCE 11.x
+
+From: Leorize <leorize+oss@disroot.org>
+
+commit da353a6b30086674c77bdbbfd86e9e0c7416ba99 upstream.
+
+When BT.2020 colorimetry is selected, the driver sends information using
+VSC SDP but does not set "ignore MSA colorimetry" bit on older GPUs with
+DCE-based IPs. This causes certain sinks to prefer colorimetry
+information in DP MSA, resulting in terrible color rendering ("dull"
+colors) when HDR is enabled.
+
+This commit wires up the MISC1 bit 6 for GPUs with DCE 11.x based IPs to
+correctly configure sinks to ignore colorimetry information in MSA,
+resolving the color rendering issue.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/4849
+Assisted-by: oh-my-pi:GPT-5.5
+Signed-off-by: Leorize <leorize+oss@disroot.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 323a09e56c1d549ce47d4f110de77b0051b4a8bf)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c | 15 ++++++++++++++-
+ drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.h | 3 ++-
+ 2 files changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c
+@@ -271,7 +271,6 @@ static void dce110_stream_encoder_dp_set
+ bool use_vsc_sdp_for_colorimetry,
+ uint32_t enable_sdp_splitting)
+ {
+- (void)use_vsc_sdp_for_colorimetry;
+ (void)enable_sdp_splitting;
+ uint32_t h_active_start;
+ uint32_t v_active_start;
+@@ -334,6 +333,16 @@ static void dce110_stream_encoder_dp_set
+ if (REG(DP_MSA_MISC))
+ misc1 = REG_READ(DP_MSA_MISC);
+
++ /* For YCbCr420 and BT2020 Colorimetry Formats, VSC SDP shall be used.
++ * When MISC1, bit 6, is Set to 1, a Source device uses a VSC SDP to indicate the
++ * Pixel Encoding/Colorimetry Format and that a Sink device shall ignore MISC1, bit 7,
++ * and MISC0, bits 7:1 (MISC1, bit 7, and MISC0, bits 7:1, become "don't care").
++ */
++ if (use_vsc_sdp_for_colorimetry)
++ misc1 = misc1 | 0x40;
++ else
++ misc1 = misc1 & ~0x40;
++
+ /* set color depth */
+
+ switch (hw_crtc_timing.display_color_depth) {
+@@ -499,6 +508,10 @@ static void dce110_stream_encoder_dp_set
+ hw_crtc_timing.h_addressable + hw_crtc_timing.h_border_right,
+ DP_MSA_VHEIGHT, hw_crtc_timing.v_border_top +
+ hw_crtc_timing.v_addressable + hw_crtc_timing.v_border_bottom);
++ } else {
++ /* DCE-only path */
++ if (REG(DP_MSA_MISC))
++ REG_WRITE(DP_MSA_MISC, misc1); /* MSA_MISC1 */
+ }
+ }
+
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.h
+@@ -96,7 +96,8 @@
+
+ #define SE_COMMON_REG_LIST(id)\
+ SE_COMMON_REG_LIST_DCE_BASE(id), \
+- SRI(AFMT_CNTL, DIG, id)
++ SRI(AFMT_CNTL, DIG, id), \
++ SRI(DP_MSA_MISC, DP, id)
+
+ #define SE_DCN_REG_LIST(id)\
+ SE_COMMON_REG_LIST_BASE(id),\
--- /dev/null
+From 75050390151a14802be433c3856ddcb483cecd24 Mon Sep 17 00:00:00 2001
+From: Honglei Huang <honghuan@amd.com>
+Date: Thu, 25 Jun 2026 16:23:47 +0800
+Subject: drm/amd/display: use kvzalloc to allocate struct dc
+
+From: Honglei Huang <honghuan@amd.com>
+
+commit 75050390151a14802be433c3856ddcb483cecd24 upstream.
+
+struct dc has grown large over time (most of it the two inlined
+dc_scratch_space copies) and now sits close to the page allocator's 4 MiB
+contiguous allocation limit. Its actual size is not fixed by the source
+alone, it also depends on the compiler and the .config, so it can easily
+cross 4 MiB, e.g. with a newer GCC or a config change.
+
+dc_create() allocates it with kzalloc(). Once struct dc exceeds 4 MiB the
+request is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER,
+so the page allocator warns and returns NULL. dc_create() then fails, DM
+init fails and amdgpu probe aborts with -EINVAL:
+
+ WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380
+ dc_create+0x38/0x660 [amdgpu]
+ amdgpu_dm_init+0x2d9/0x510 [amdgpu]
+ dm_hw_init+0x1b/0x90 [amdgpu]
+ amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu]
+ amdgpu_driver_load_kms+0x19/0x80 [amdgpu]
+ amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu]
+
+dc_create() then returns NULL and DM init fails, which aborts the whole
+GPU init and makes amdgpu probe fail with -EINVAL ("hw_init of IP block
+<dm> failed -22"), leaving the display unusable. The subsequent
+amdgpu_irq_put() warnings during teardown are just fallout of unwinding
+a half-initialized device.
+
+struct dc is a software-only bookkeeping structure that is never handed
+to hardware DMA and is only ever kept as an opaque pointer, so it does
+not require physically contiguous memory. Allocate it with kvzalloc()
+(and free it with kvfree()) so that the allocator can fall back to
+vmalloc() when a contiguous allocation of that size is not available,
+which also avoids the MAX_PAGE_ORDER warning entirely.
+
+v2:
+ - Rebase to amd-staging-drm-next.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5406
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Honglei Huang <honghuan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 991e0516a8072f2292681c6ae98a924ab0e32575)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -1507,7 +1507,7 @@ static void disable_vbios_mode_if_requir
+
+ struct dc *dc_create(const struct dc_init_data *init_params)
+ {
+- struct dc *dc = kzalloc_obj(*dc);
++ struct dc *dc = kvzalloc_obj(*dc);
+ unsigned int full_pipe_count;
+
+ if (!dc)
+@@ -1555,7 +1555,7 @@ struct dc *dc_create(const struct dc_ini
+
+ destruct_dc:
+ dc_destruct(dc);
+- kfree(dc);
++ kvfree(dc);
+ return NULL;
+ }
+
+@@ -1604,7 +1604,7 @@ void dc_deinit_callbacks(struct dc *dc)
+ void dc_destroy(struct dc **dc)
+ {
+ dc_destruct(*dc);
+- kfree(*dc);
++ kvfree(*dc);
+ *dc = NULL;
+ }
+
--- /dev/null
+From b181bf68d11f034efe27ae1377a0f659605f040f Mon Sep 17 00:00:00 2001
+From: Prike Liang <Prike.Liang@amd.com>
+Date: Wed, 17 Jun 2026 14:20:16 +0800
+Subject: drm/amdgpu: add the doorbell index input for suspending userq
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Prike Liang <Prike.Liang@amd.com>
+
+commit b181bf68d11f034efe27ae1377a0f659605f040f upstream.
+
+It requires inputing the doorbell offset for MES firmware preempts the
+userq, and adding the doorbell offset also keep aliging with the
+union MESAPI__SUSPEND in MES firmware.
+
+Signed-off-by: Prike Liang <Prike.Liang@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit bc434335ab3c096a33a9e88c7951b4ac574db458)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h
+@@ -288,12 +288,14 @@ struct mes_suspend_gang_input {
+ uint64_t gang_context_addr;
+ uint64_t suspend_fence_addr;
+ uint32_t suspend_fence_value;
++ uint32_t doorbell_offset;
+ };
+
+ struct mes_resume_gang_input {
+ uint32_t xcc_id;
+ bool resume_all_gangs;
+ uint64_t gang_context_addr;
++ uint32_t doorbell_offset;
+ };
+
+ struct mes_reset_queue_input {
--- /dev/null
+From 9e98ed3113943257ad6e5c1e6beddbdb482a70ad Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:26:28 -0400
+Subject: drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 9e98ed3113943257ad6e5c1e6beddbdb482a70ad upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
+@@ -527,7 +527,7 @@ static void sdma_v5_0_ring_emit_fence(st
+ amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) |
+ SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -538,7 +538,7 @@ static void sdma_v5_0_ring_emit_fence(st
+ amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) |
+ SDMA_PKT_FENCE_HEADER_MTYPE(0x3));
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(seq));
--- /dev/null
+From b9dd618a635d39fbb211454b6e8837b2a7f10fb0 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:27:15 -0400
+Subject: drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit b9dd618a635d39fbb211454b6e8837b2a7f10fb0 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ae658afc7f47f6147371ec42cc6b1a793dfdb5af)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
+@@ -377,7 +377,7 @@ static void sdma_v5_2_ring_emit_fence(st
+ amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) |
+ SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -388,7 +388,7 @@ static void sdma_v5_2_ring_emit_fence(st
+ amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) |
+ SDMA_PKT_FENCE_HEADER_MTYPE(0x3));
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(seq));
--- /dev/null
+From ec42c96c322e5cc48099ab5e67b5cbe236cb1949 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:27:54 -0400
+Subject: drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit ec42c96c322e5cc48099ab5e67b5cbe236cb1949 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c
+@@ -360,7 +360,7 @@ static void sdma_v6_0_ring_emit_fence(st
+ amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) |
+ SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -371,7 +371,7 @@ static void sdma_v6_0_ring_emit_fence(st
+ amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) |
+ SDMA_PKT_FENCE_HEADER_MTYPE(0x3));
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(seq));
--- /dev/null
+From e80e28f398f5d9f6e361ffb56382d2e74fc87556 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:28:29 -0400
+Subject: drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit e80e28f398f5d9f6e361ffb56382d2e74fc87556 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c
+@@ -363,7 +363,7 @@ static void sdma_v7_0_ring_emit_fence(st
+ amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) |
+ SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -374,7 +374,7 @@ static void sdma_v7_0_ring_emit_fence(st
+ amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) |
+ SDMA_PKT_FENCE_HEADER_MTYPE(0x3));
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(seq));
--- /dev/null
+From bbb15a6b042d02e5508a02b4847e02d2579ee7bc Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Thu, 25 Jun 2026 20:03:04 +0300
+Subject: drm/i915/hdcp: check streams[] bounds before overflow
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit bbb15a6b042d02e5508a02b4847e02d2579ee7bc upstream.
+
+The data->streams[] overflow check is done after the buffer overflow has
+already happened. Move the overflow check before the write.
+
+Side note, emitting a warning splat with a backtrace might be overkill
+here, but prefer not changing the behaviour other than not doing the
+overrun.
+
+Discovered using AI-assisted static analysis confirmed by Intel Product
+Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: e03187e12cae ("drm/i915/hdcp: MST streams support in hdcp port_data")
+Cc: stable@vger.kernel.org # v5.12+
+Cc: Anshuman Gupta <anshuman.gupta@intel.com>
+Cc: Suraj Kandpal <suraj.kandpal@intel.com>
+Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
+Link: https://patch.msgid.link/20260625170304.1104723-1-jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_hdcp.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_hdcp.c
++++ b/drivers/gpu/drm/i915/display/intel_hdcp.c
+@@ -132,6 +132,9 @@ intel_hdcp_required_content_stream(struc
+ if (conn_dig_port != dig_port)
+ continue;
+
++ if (drm_WARN_ON(display->drm, data->k >= INTEL_NUM_PIPES(display)))
++ return -EINVAL;
++
+ data->streams[data->k].stream_id =
+ intel_conn_to_vcpi(state, connector);
+ data->k++;
+@@ -142,7 +145,7 @@ intel_hdcp_required_content_stream(struc
+ }
+ drm_connector_list_iter_end(&conn_iter);
+
+- if (drm_WARN_ON(display->drm, data->k > INTEL_NUM_PIPES(display) || data->k == 0))
++ if (drm_WARN_ON(display->drm, !data->k))
+ return -EINVAL;
+
+ /*
--- /dev/null
+From db9e64c983dcb07ff256bd455f258c44aa530ff8 Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Thu, 25 Jun 2026 13:44:07 +0300
+Subject: drm/i915/hdcp: require monotonically increasing seq_num_v
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit db9e64c983dcb07ff256bd455f258c44aa530ff8 upstream.
+
+The HDCP 2.2 specification requires the seq_num_v to be monotonically
+increasing, and repeated seq_num_v needs to be treated as an integrity
+failure. Make it so.
+
+For the first message, seq_num_v must be zero, and is already
+checked. We can only check for less-than-or-equal for the subsequent
+messages, where hdcp2_encrypted is true.
+
+Discovered using AI-assisted static analysis confirmed by Intel Product
+Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: d849178e2c9e ("drm/i915: Implement HDCP2.2 repeater authentication")
+Cc: stable@vger.kernel.org # v5.2+
+Cc: Suraj Kandpal <suraj.kandpal@intel.com>
+Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
+Link: https://patch.msgid.link/20260625104407.1025614-1-jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 58a224375c81179b52558c53d8857b93196d2687)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_hdcp.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_hdcp.c
++++ b/drivers/gpu/drm/i915/display/intel_hdcp.c
+@@ -1785,9 +1785,10 @@ int hdcp2_authenticate_repeater_topology
+ return -EINVAL;
+ }
+
+- if (seq_num_v < hdcp->seq_num_v) {
+- /* Roll over of the seq_num_v from repeater. Reauthenticate. */
+- drm_dbg_kms(display->drm, "Seq_num_v roll over.\n");
++ if (hdcp->hdcp2_encrypted && seq_num_v <= hdcp->seq_num_v) {
++ /* Reauthenticate on Seq_num_v repeat or rollover */
++ drm_dbg_kms(display->drm, "Seq_num_v %s\n",
++ seq_num_v == hdcp->seq_num_v ? "repeat" : "rollover");
+ return -EINVAL;
+ }
+
--- /dev/null
+From f8a9262c7a6fc2de9802e14b0228114f0333869e Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Thu, 25 Jun 2026 16:10:40 +0300
+Subject: drm/i915/vrr: require valid min/max vfreq for VRR
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit f8a9262c7a6fc2de9802e14b0228114f0333869e upstream.
+
+Ensure the EDID provided min/max vfreq are valid. Most scenarios are
+already covered (by coincidence) through the checks in
+intel_vrr_is_capable() and intel_vrr_is_in_range(), but be more explicit
+about it. At worst, a zero min_vfreq could lead to a division by zero in
+intel_vrr_compute_vmax().
+
+Discovered using AI-assisted static analysis confirmed by Intel Product
+Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: 117cd09ba528 ("drm/i915/display/dp: Compute VRR state in atomic_check")
+Cc: stable@vger.kernel.org # v5.12+
+Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Link: https://patch.msgid.link/20260625131040.1051272-1-jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 1765cf59f517b02f3b0591fe5120930d08bddeb6)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_vrr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/i915/display/intel_vrr.c
++++ b/drivers/gpu/drm/i915/display/intel_vrr.c
+@@ -64,6 +64,10 @@ bool intel_vrr_is_capable(struct intel_c
+ return false;
+ }
+
++ if (!info->monitor_range.min_vfreq || !info->monitor_range.max_vfreq ||
++ info->monitor_range.min_vfreq > info->monitor_range.max_vfreq)
++ return false;
++
+ return info->monitor_range.max_vfreq - info->monitor_range.min_vfreq > 10;
+ }
+
--- /dev/null
+From 4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Sat, 20 Jun 2026 21:43:34 -0500
+Subject: drm/virtio: bound EDID block reads to the response buffer
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit 4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd upstream.
+
+virtio_get_edid_block() validates the read offset only against the
+device-supplied resp->size field, never against the fixed-size resp->edid
+array. The EDID block index is driven by the device-supplied extension
+count, so a malicious virtio-gpu backend can advertise a large size
+together with a high block count and read far past the array into adjacent
+kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds
+read / info leak).
+
+Also reject any read whose end exceeds the size of the edid array.
+Conforming EDID responses stay within the array and are unaffected.
+
+Fixes: b4b01b4995fb ("drm/virtio: add edid support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Link: https://patch.msgid.link/20260620-b4-disp-22bba7bf-v1-1-b95924cee742@proton.me
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_vq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -894,7 +894,8 @@ static int virtio_get_edid_block(void *d
+ struct virtio_gpu_resp_edid *resp = data;
+ size_t start = block * EDID_LENGTH;
+
+- if (start + len > le32_to_cpu(resp->size))
++ if (start + len > le32_to_cpu(resp->size) ||
++ start + len > sizeof(resp->edid))
+ return -EINVAL;
+ memcpy(buf, resp->edid + start, len);
+ return 0;
--- /dev/null
+From f39283eab44fb7e304677b2aa1d8c38f151b6566 Mon Sep 17 00:00:00 2001
+From: Leo Li <sunpeng.li@amd.com>
+Date: Mon, 4 May 2026 14:09:49 -0400
+Subject: Revert "drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs"
+
+From: Leo Li <sunpeng.li@amd.com>
+
+commit f39283eab44fb7e304677b2aa1d8c38f151b6566 upstream.
+
+Now that proper fixes have been found, let's revert this workaround.
+
+This reverts commit a1fc7bf6677eb547167cb72b3bcafdc34b976692.
+
+Tested-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit f64a9be5653689ff43e148cd8a6483077488c8e5)
+Cc: stable@vger.kernel.org # 8382cd234981: drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
+Cc: stable@vger.kernel.org # 48ab86360af1: drm/amd/display: check GRPH_FLIP status before sending event
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 18 +++---------------
+ 1 file changed, 3 insertions(+), 15 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -9427,21 +9427,9 @@ static void manage_dm_interrupts(struct
+ if (acrtc_state) {
+ timing = &acrtc_state->stream->timing;
+
+- if (amdgpu_ip_version(adev, DCE_HWIP, 0) >=
+- IP_VERSION(3, 2, 0) &&
+- !(adev->flags & AMD_IS_APU)) {
+- /*
+- * DGPUs NV3x and newer that support idle optimizations
+- * experience intermittent flip-done timeouts on cursor
+- * updates. Restore 5s offdelay behavior for now.
+- *
+- * Discussion on the issue:
+- * https://lore.kernel.org/amd-gfx/20260217191632.1243826-1-sysdadmin@m1k.cloud/
+- */
+- config.offdelay_ms = 5000;
+- config.disable_immediate = false;
+- } else if (amdgpu_ip_version(adev, DCE_HWIP, 0) <
+- IP_VERSION(3, 5, 0)) {
++ if (amdgpu_ip_version(adev, DCE_HWIP, 0) <
++ IP_VERSION(3, 5, 0) ||
++ !(adev->flags & AMD_IS_APU)) {
+ /*
+ * Older HW and DGPU have issues with instant off;
+ * use a 2 frame offdelay.
drm-amdkfd-check-bounds-on-criu-restore-queue-type-and-mqd-size.patch
drm-amdkfd-fix-32-bit-overflow-in-cwsr-total-size-calculation.patch
drm-amdkfd-free-mqd-managers-on-dqm-init-failures.patch
+drm-amd-display-set-msa-misc1-bit-6-when-using-vsc-sdp-for-dce-11.x.patch
+drm-amd-display-handle-struct-drm_plane_state.ignore_damage_clips.patch
+drm-amd-display-use-kvzalloc-to-allocate-struct-dc.patch
+drm-amd-display-detect_link_and_local_sink-dp-alt-mode-timeout-path-leaks-prev_sink-reference.patch
+revert-drm-amd-display-restore-5s-vbl-offdelay-for-nv3x-dgpus.patch
+drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch
+drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch
+drm-i915-hdcp-require-monotonically-increasing-seq_num_v.patch
+drm-i915-hdcp-check-streams-bounds-before-overflow.patch
+drm-amdgpu-add-the-doorbell-index-input-for-suspending-userq.patch
+drm-amdgpu-sdma7.0-replace-bug_on-with-warn_on.patch
+drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch
+drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch
+drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
