--- /dev/null
+From d340cba0df4cf327c7e89c7c1a4e79d4771d7dd5 Mon Sep 17 00:00:00 2001
+From: Andriy Korud <a.korud@gmail.com>
+Date: Fri, 10 Jul 2026 12:52:26 +0200
+Subject: drm/amd/display: dce100: skip non-DP stream encoders for DP MST
+
+From: Andriy Korud <a.korud@gmail.com>
+
+commit d340cba0df4cf327c7e89c7c1a4e79d4771d7dd5 upstream.
+
+On DCE8-class ASICs (e.g. Bonaire), the resource pool contains digital
+DIG stream encoders plus one analog DAC encoder. When assigning a stream
+encoder for a second DisplayPort MST stream, if the preferred digital
+encoder is already acquired, dce100_find_first_free_match_stream_enc_for_link()
+falls back to the first free pool entry. That entry may be the analog
+encoder, whose funcs table lacks DP hooks such as dp_set_stream_attribute.
+The subsequent atomic commit then dereferences NULL function pointers in
+link_set_dpms_on() and crashes.
+
+Skip encoders without dp_set_stream_attribute when the stream uses a DP
+signal (including MST). Use dc_is_dp_signal(stream->signal) for the MST
+fallback path instead of checking only the link connector signal.
+
+Tested on:
+- GPU: AMD Radeon R7 260X (Bonaire / DCE8)
+- Board: Supermicro C9X299-PG300
+- Setup: DP MST daisy chain, hotplug second monitor or have it connected on boot
+- Kernel: 7.1.3 (issue observed since 6.19)
+- Result: kernel oops without patch; dual monitors stable with patch
+
+Signed-off-by: Andriy Korud <a.korud@gmail.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5162
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 28ec64943e3ee4d9b8d30cea61e380f1429953a8)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/resource/dce100/dce100_resource.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/resource/dce100/dce100_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dce100/dce100_resource.c
+@@ -939,6 +939,11 @@ struct stream_encoder *dce100_find_first
+ for (i = 0; i < pool->stream_enc_count; i++) {
+ if (!res_ctx->is_stream_enc_acquired[i] &&
+ pool->stream_enc[i]) {
++ /* DP/MST needs a digital encoder; skip analog/no-DP encoders */
++ if (dc_is_dp_signal(stream->signal) &&
++ (!pool->stream_enc[i]->funcs ||
++ !pool->stream_enc[i]->funcs->dp_set_stream_attribute))
++ continue;
+ /* Store first available for MST second display
+ * in daisy chain use case
+ */
+@@ -962,7 +967,7 @@ struct stream_encoder *dce100_find_first
+ * required for non DP connectors.
+ */
+
+- if (j >= 0 && link->connector_signal == SIGNAL_TYPE_DISPLAY_PORT)
++ if (j >= 0 && dc_is_dp_signal(stream->signal))
+ return pool->stream_enc[j];
+
+ return NULL;
--- /dev/null
+From 9fa26b9eed6195bf840f39ac183b9a6237548755 Mon Sep 17 00:00:00 2001
+From: WenTao Liang <vulab@iscas.ac.cn>
+Date: Sun, 28 Jun 2026 15:27:40 +0800
+Subject: drm/amd/display: set new_stream to NULL after release
+
+From: WenTao Liang <vulab@iscas.ac.cn>
+
+commit 9fa26b9eed6195bf840f39ac183b9a6237548755 upstream.
+
+In dm_update_crtc_state(), the skip_modeset path releases new_stream
+via dc_stream_release() but does not set the pointer to NULL.
+
+If a later error (e.g., color management failure) triggers the fail
+label, the error path calls dc_stream_release() again on the same
+dangling pointer, causing a double release and potential use-after-free.
+
+Fix this by setting new_stream to NULL after the initial release.
+
+Fixes: 9b690ef3c704 ("drm/amd/display: Avoid full modeset when not required")
+Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
+Reviewed-by: George Zhang <george.zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -10836,6 +10836,7 @@ skip_modeset:
+ /* Release extra reference */
+ if (new_stream)
+ dc_stream_release(new_stream);
++ new_stream = NULL;
+
+ /*
+ * We want to do dc stream updates that do not require a
--- /dev/null
+From 85371c5ef502d10add72eab38711e191dccea981 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timur=20Krist=C3=B3f?= <timur.kristof@gmail.com>
+Date: Mon, 13 Jul 2026 08:14:43 +0200
+Subject: drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+commit 85371c5ef502d10add72eab38711e191dccea981 upstream.
+
+The old radeon driver has a documented workaround in ci_dpm.c
+which claims that Bonaire 0x6658 with old memory controller
+firmware is unstable with MCLK DPM, so as a precaution I
+disabled MCLK DPM on this ASIC in amdgpu.
+
+Note that the old MC firmware is not actually used with
+amdgpu, but in theory it's possible that the VBIOS sets
+up the ASIC with an old MC firmware that is already running
+when amdgpu initializes (in which case amdgpu doesn't
+load its own firmware).
+
+What I expected to happen is that the GPU would simply use
+its maximum memory clock, and indeed this is what seemed
+to happen according to amdgpu_pm_info which reads the
+current MCLK value from the SMU.
+However, some users reported a huge perf regression
+and upon a closer look it seems that the GPU seems to
+not actually use the highest MCLK value, despite the SMU
+reporting that it does.
+
+Let's not disable MCLK DPM on Bonaire 0x6658 (R7 260X).
+
+Keep MCLK DPM disabled on R9 M380 in the 2015 iMac
+because that still hangs if we enable it.
+
+Fixes: 9851f29cb06c ("drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs")
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit d34acad064ee7d82bd18f5d87592c422d4d323ac)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c
+@@ -106,11 +106,8 @@ int hwmgr_early_init(struct pp_hwmgr *hw
+ hwmgr->od_enabled = false;
+ switch (hwmgr->chip_id) {
+ case CHIP_BONAIRE:
+- /* R9 M380 in iMac 2015: SMU hangs when enabling MCLK DPM
+- * R7 260X cards with old MC ucode: MCLK DPM is unstable
+- */
+- if (adev->pdev->subsystem_vendor == 0x106B ||
+- adev->pdev->device == 0x6658) {
++ /* R9 M380 in iMac 2015: SMU hangs when enabling MCLK DPM */
++ if (adev->pdev->subsystem_vendor == 0x106B) {
+ dev_info(adev->dev, "disabling MCLK DPM on quirky ASIC");
+ adev->pm.pp_feature &= ~PP_MCLK_DPM_MASK;
+ hwmgr->feature_mask &= ~PP_MCLK_DPM_MASK;
--- /dev/null
+From db7e8108809a2245f0a17ba323f027cac0941ffb Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Wed, 8 Jul 2026 14:35:14 -0500
+Subject: drm/amdgpu: Fix VFCT bus number matching with soft filter
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit db7e8108809a2245f0a17ba323f027cac0941ffb upstream.
+
+On systems where PCI bus renumbering occurs (e.g. pci=realloc,
+resource conflicts), the runtime bus number may differ from the
+BIOS POST bus number recorded in the VFCT table. This causes
+amdgpu_acpi_vfct_bios() to fail finding the VBIOS even though
+the correct device entry exists.
+
+Introduce amdgpu_acpi_vfct_match() which treats the bus number
+as a soft filter: vendor/device/function identity is the hard
+requirement, while exact bus match is the preferred path. When
+bus numbers disagree but device identity matches, accept the
+VFCT entry and log a dev_notice for diagnostics.
+
+Reported-by: Oz Tiram <oz@shift-computing.de>
+Closes: https://lore.kernel.org/amd-gfx/20260621173211.28443-1-oz@shift-computing.de/
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Link: https://patch.msgid.link/20260708193518.702584-2-mario.limonciello@amd.com
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 11c141672045ffc0187aa604f2c0f597bc334fb2)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 45 +++++++++++++++++++++++++++----
+ 1 file changed, 40 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+@@ -345,6 +345,45 @@ static bool amdgpu_read_disabled_bios(st
+ }
+
+ #ifdef CONFIG_ACPI
++/**
++ * amdgpu_acpi_vfct_match() - Check if a VFCT entry matches the device
++ * @adev: AMDGPU device
++ * @vhdr: VFCT image header to check
++ *
++ * VFCT entries contain the PCI bus number as recorded during BIOS POST.
++ * On systems where the kernel renumbers PCI buses (e.g. pci=realloc or
++ * resource conflicts), the runtime bus number may differ from the POST
++ * value. Match by device identity (vendor + device + function) and use
++ * the bus number as a preference: exact bus match is preferred, but when
++ * the bus numbers disagree we accept the entry if the device identity
++ * matches.
++ *
++ * Returns: 0 on match, -ENODEV on no match
++ */
++static int amdgpu_acpi_vfct_match(struct amdgpu_device *adev,
++ VFCT_IMAGE_HEADER *vhdr)
++{
++ /* Vendor and device IDs must always match */
++ if (vhdr->VendorID != adev->pdev->vendor ||
++ vhdr->DeviceID != adev->pdev->device)
++ return -ENODEV;
++
++ if (vhdr->PCIDevice != PCI_SLOT(adev->pdev->devfn) ||
++ vhdr->PCIFunction != PCI_FUNC(adev->pdev->devfn))
++ return -ENODEV;
++
++ /* Exact bus number match - preferred */
++ if (vhdr->PCIBus == adev->pdev->bus->number)
++ return 0;
++
++ /* Bus mismatch but device identity matches (PCI renumbering case) */
++ dev_notice(adev->dev,
++ "VFCT bus number mismatch: table %u != runtime %u, matching by device identity (vendor 0x%04x device 0x%04x)\n",
++ vhdr->PCIBus, adev->pdev->bus->number,
++ adev->pdev->vendor, adev->pdev->device);
++ return 0;
++}
++
+ static bool amdgpu_acpi_vfct_bios(struct amdgpu_device *adev)
+ {
+ struct acpi_table_header *hdr;
+@@ -380,11 +419,7 @@ static bool amdgpu_acpi_vfct_bios(struct
+ }
+
+ if (vhdr->ImageLength &&
+- vhdr->PCIBus == adev->pdev->bus->number &&
+- vhdr->PCIDevice == PCI_SLOT(adev->pdev->devfn) &&
+- vhdr->PCIFunction == PCI_FUNC(adev->pdev->devfn) &&
+- vhdr->VendorID == adev->pdev->vendor &&
+- vhdr->DeviceID == adev->pdev->device) {
++ !amdgpu_acpi_vfct_match(adev, vhdr)) {
+ adev->bios = kmemdup(&vbios->VbiosContent,
+ vhdr->ImageLength,
+ GFP_KERNEL);
--- /dev/null
+From 4a2c8cbe9bcba170706fdf08b1c84b6cbcf5b044 Mon Sep 17 00:00:00 2001
+From: Osama Abdelkader <osama.abdelkader@gmail.com>
+Date: Tue, 14 Jul 2026 18:30:55 +0200
+Subject: drm/panthor: return error on truncated firmware
+
+From: Osama Abdelkader <osama.abdelkader@gmail.com>
+
+commit 4a2c8cbe9bcba170706fdf08b1c84b6cbcf5b044 upstream.
+
+panthor_fw_load() detects truncated firmware images, but jumps to the
+common cleanup path without setting ret. If no previous error was recorded,
+the function can return 0 and treat the invalid firmware as successfully
+loaded.
+
+Set ret to -EINVAL before leaving the truncated-image path.
+
+Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
+Cc: stable@vger.kernel.org
+Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
+Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Link: https://patch.msgid.link/20260714163056.22329-1-osama.abdelkader@gmail.com
+Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panthor/panthor_fw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/panthor/panthor_fw.c
++++ b/drivers/gpu/drm/panthor/panthor_fw.c
+@@ -732,6 +732,7 @@ static int panthor_fw_load(struct pantho
+ }
+
+ if (hdr.size > iter.size) {
++ ret = -EINVAL;
+ drm_err(&ptdev->base, "Firmware image is truncated\n");
+ goto out;
+ }
drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch
drm-amd-pm-fix-smu14-power-limit-range-calculation.patch
drm-gfx10-program-db_ring_control.patch
+drm-panthor-return-error-on-truncated-firmware.patch
+drm-amdgpu-fix-vfct-bus-number-matching-with-soft-filter.patch
+drm-amd-pm-ci-don-t-disable-mclk-dpm-on-bonaire-0x6658-r7-260x.patch
+drm-amd-display-set-new_stream-to-null-after-release.patch
+drm-amd-display-dce100-skip-non-dp-stream-encoders-for-dp-mst.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
