From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 11:19:38 +0000 (+0200) Subject: 7.1-stable patches X-Git-Tag: v6.1.179~54 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=317a44bc19b6c58ebe2156f65e96ae62c8147903;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: drm-amd-display-detect_link_and_local_sink-dp-alt-mode-timeout-path-leaks-prev_sink-reference.patch drm-amd-display-handle-struct-drm_plane_state.ignore_damage_clips.patch drm-amd-display-set-msa-misc1-bit-6-when-using-vsc-sdp-for-dce-11.x.patch drm-amd-display-use-kvzalloc-to-allocate-struct-dc.patch drm-amdgpu-add-the-doorbell-index-input-for-suspending-userq.patch drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma7.0-replace-bug_on-with-warn_on.patch drm-i915-hdcp-check-streams-bounds-before-overflow.patch drm-i915-hdcp-require-monotonically-increasing-seq_num_v.patch drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch revert-drm-amd-display-restore-5s-vbl-offdelay-for-nv3x-dgpus.patch --- diff --git a/queue-7.1/drm-amd-display-detect_link_and_local_sink-dp-alt-mode-timeout-path-leaks-prev_sink-reference.patch b/queue-7.1/drm-amd-display-detect_link_and_local_sink-dp-alt-mode-timeout-path-leaks-prev_sink-reference.patch new file mode 100644 index 0000000000..35c6c474f8 --- /dev/null +++ b/queue-7.1/drm-amd-display-detect_link_and_local_sink-dp-alt-mode-timeout-path-leaks-prev_sink-reference.patch @@ -0,0 +1,43 @@ +From a6e14b976be48eebd8769cb5b883a6af7fc5ade1 Mon Sep 17 00:00:00 2001 +From: WenTao Liang +Date: Fri, 26 Jun 2026 20:45:55 +0800 +Subject: drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference + +From: WenTao Liang + +commit a6e14b976be48eebd8769cb5b883a6af7fc5ade1 upstream. + +prev_sink is unconditionally retained via dc_sink_retain at function + entry, but the DP alt mode timeout path inside SIGNAL_TYPE_DISPLAY_PORT + returns false without releasing prev_sink. All other return paths in the + function correctly call dc_sink_release(prev_sink), making this the only + missing cleanup. + +Fixes: 54618888d1ea ("drm/amd/display: break down dc_link.c") +Signed-off-by: WenTao Liang +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/20260626124555.36910-1-vulab@iscas.ac.cn +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit 45510cf662dcf46b5d8926d454f338809f107b9d) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/link/link_detection.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c ++++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c +@@ -1069,8 +1069,11 @@ static bool detect_link_and_local_sink(s + link->link_enc->features.flags.bits.DP_IS_USB_C == 1) { + + /* if alt mode times out, return false */ +- if (!wait_for_entering_dp_alt_mode(link)) ++ if (!wait_for_entering_dp_alt_mode(link)) { ++ if (prev_sink) ++ dc_sink_release(prev_sink); + return false; ++ } + } + + if (!detect_dp(link, &sink_caps, reason)) { diff --git a/queue-7.1/drm-amd-display-handle-struct-drm_plane_state.ignore_damage_clips.patch b/queue-7.1/drm-amd-display-handle-struct-drm_plane_state.ignore_damage_clips.patch new file mode 100644 index 0000000000..a005284a4c --- /dev/null +++ b/queue-7.1/drm-amd-display-handle-struct-drm_plane_state.ignore_damage_clips.patch @@ -0,0 +1,64 @@ +From ac11060c6d4959e2d4ceada037d2e1e1bfcf6645 Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Wed, 10 Jun 2026 17:18:17 +0200 +Subject: drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips + +From: Thomas Zimmermann + +commit ac11060c6d4959e2d4ceada037d2e1e1bfcf6645 upstream. + +The mode-setting pipeline can disabled damage clippings for a commit +by setting ignore_damage_clips in struct drm_plane_state. The commit +will then do a full display update. + +Test the flag in DCN code and do a full update in DCN code if it has +been set. + +Commit 35ed38d58257 ("drm: Allow drivers to indicate the damage helpers +to ignore damage clips") introduced ignore_damage_clips to selectively +ignore damage clipping in certain framebuffer changes. This driver does +not do that, but DRM's damage iterator will soon rely on the flag. +Therefore supporting it here as well make sense for consistency. + +Signed-off-by: Thomas Zimmermann +Fixes: 35ed38d58257 ("drm: Allow drivers to indicate the damage helpers to ignore damage clips") +Cc: Javier Martinez Canillas +Cc: Thomas Zimmermann +Cc: Zack Rusin +Cc: dri-devel@lists.freedesktop.org +Reviewed-by: Javier Martinez Canillas +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +(cherry picked from commit a24019f6480fad5c077b5956eed942c8960323d6) +Cc: # v6.8+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -6440,8 +6440,8 @@ static void fill_dc_dirty_rects(struct d + { + struct dm_crtc_state *dm_crtc_state = to_dm_crtc_state(crtc_state); + struct rect *dirty_rects = flip_addrs->dirty_rects; +- u32 num_clips; +- struct drm_mode_rect *clips; ++ u32 num_clips = 0; ++ struct drm_mode_rect *clips = NULL; + bool bb_changed; + bool fb_changed; + u32 i = 0; +@@ -6457,8 +6457,10 @@ static void fill_dc_dirty_rects(struct d + if (new_plane_state->rotation != DRM_MODE_ROTATE_0) + goto ffu; + +- num_clips = drm_plane_get_damage_clips_count(new_plane_state); +- clips = drm_plane_get_damage_clips(new_plane_state); ++ if (!new_plane_state->ignore_damage_clips) { ++ num_clips = drm_plane_get_damage_clips_count(new_plane_state); ++ clips = drm_plane_get_damage_clips(new_plane_state); ++ } + + if (num_clips && (!amdgpu_damage_clips || (amdgpu_damage_clips < 0 && + is_psr_su))) diff --git a/queue-7.1/drm-amd-display-set-msa-misc1-bit-6-when-using-vsc-sdp-for-dce-11.x.patch b/queue-7.1/drm-amd-display-set-msa-misc1-bit-6-when-using-vsc-sdp-for-dce-11.x.patch new file mode 100644 index 0000000000..7edb201222 --- /dev/null +++ b/queue-7.1/drm-amd-display-set-msa-misc1-bit-6-when-using-vsc-sdp-for-dce-11.x.patch @@ -0,0 +1,81 @@ +From da353a6b30086674c77bdbbfd86e9e0c7416ba99 Mon Sep 17 00:00:00 2001 +From: Leorize +Date: Mon, 18 May 2026 20:06:19 -0700 +Subject: drm/amd/display: set MSA MISC1 bit 6 when using VSC SDP for DCE 11.x + +From: Leorize + +commit da353a6b30086674c77bdbbfd86e9e0c7416ba99 upstream. + +When BT.2020 colorimetry is selected, the driver sends information using +VSC SDP but does not set "ignore MSA colorimetry" bit on older GPUs with +DCE-based IPs. This causes certain sinks to prefer colorimetry +information in DP MSA, resulting in terrible color rendering ("dull" +colors) when HDR is enabled. + +This commit wires up the MISC1 bit 6 for GPUs with DCE 11.x based IPs to +correctly configure sinks to ignore colorimetry information in MSA, +resolving the color rendering issue. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/4849 +Assisted-by: oh-my-pi:GPT-5.5 +Signed-off-by: Leorize +Signed-off-by: Alex Deucher +(cherry picked from commit 323a09e56c1d549ce47d4f110de77b0051b4a8bf) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c | 15 ++++++++++++++- + drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.h | 3 ++- + 2 files changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c +@@ -271,7 +271,6 @@ static void dce110_stream_encoder_dp_set + bool use_vsc_sdp_for_colorimetry, + uint32_t enable_sdp_splitting) + { +- (void)use_vsc_sdp_for_colorimetry; + (void)enable_sdp_splitting; + uint32_t h_active_start; + uint32_t v_active_start; +@@ -334,6 +333,16 @@ static void dce110_stream_encoder_dp_set + if (REG(DP_MSA_MISC)) + misc1 = REG_READ(DP_MSA_MISC); + ++ /* For YCbCr420 and BT2020 Colorimetry Formats, VSC SDP shall be used. ++ * When MISC1, bit 6, is Set to 1, a Source device uses a VSC SDP to indicate the ++ * Pixel Encoding/Colorimetry Format and that a Sink device shall ignore MISC1, bit 7, ++ * and MISC0, bits 7:1 (MISC1, bit 7, and MISC0, bits 7:1, become "don't care"). ++ */ ++ if (use_vsc_sdp_for_colorimetry) ++ misc1 = misc1 | 0x40; ++ else ++ misc1 = misc1 & ~0x40; ++ + /* set color depth */ + + switch (hw_crtc_timing.display_color_depth) { +@@ -499,6 +508,10 @@ static void dce110_stream_encoder_dp_set + hw_crtc_timing.h_addressable + hw_crtc_timing.h_border_right, + DP_MSA_VHEIGHT, hw_crtc_timing.v_border_top + + hw_crtc_timing.v_addressable + hw_crtc_timing.v_border_bottom); ++ } else { ++ /* DCE-only path */ ++ if (REG(DP_MSA_MISC)) ++ REG_WRITE(DP_MSA_MISC, misc1); /* MSA_MISC1 */ + } + } + +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.h +@@ -96,7 +96,8 @@ + + #define SE_COMMON_REG_LIST(id)\ + SE_COMMON_REG_LIST_DCE_BASE(id), \ +- SRI(AFMT_CNTL, DIG, id) ++ SRI(AFMT_CNTL, DIG, id), \ ++ SRI(DP_MSA_MISC, DP, id) + + #define SE_DCN_REG_LIST(id)\ + SE_COMMON_REG_LIST_BASE(id),\ diff --git a/queue-7.1/drm-amd-display-use-kvzalloc-to-allocate-struct-dc.patch b/queue-7.1/drm-amd-display-use-kvzalloc-to-allocate-struct-dc.patch new file mode 100644 index 0000000000..f134bc7f3f --- /dev/null +++ b/queue-7.1/drm-amd-display-use-kvzalloc-to-allocate-struct-dc.patch @@ -0,0 +1,84 @@ +From 75050390151a14802be433c3856ddcb483cecd24 Mon Sep 17 00:00:00 2001 +From: Honglei Huang +Date: Thu, 25 Jun 2026 16:23:47 +0800 +Subject: drm/amd/display: use kvzalloc to allocate struct dc + +From: Honglei Huang + +commit 75050390151a14802be433c3856ddcb483cecd24 upstream. + +struct dc has grown large over time (most of it the two inlined +dc_scratch_space copies) and now sits close to the page allocator's 4 MiB +contiguous allocation limit. Its actual size is not fixed by the source +alone, it also depends on the compiler and the .config, so it can easily +cross 4 MiB, e.g. with a newer GCC or a config change. + +dc_create() allocates it with kzalloc(). Once struct dc exceeds 4 MiB the +request is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER, +so the page allocator warns and returns NULL. dc_create() then fails, DM +init fails and amdgpu probe aborts with -EINVAL: + + WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380 + dc_create+0x38/0x660 [amdgpu] + amdgpu_dm_init+0x2d9/0x510 [amdgpu] + dm_hw_init+0x1b/0x90 [amdgpu] + amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu] + amdgpu_driver_load_kms+0x19/0x80 [amdgpu] + amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu] + +dc_create() then returns NULL and DM init fails, which aborts the whole +GPU init and makes amdgpu probe fail with -EINVAL ("hw_init of IP block + failed -22"), leaving the display unusable. The subsequent +amdgpu_irq_put() warnings during teardown are just fallout of unwinding +a half-initialized device. + +struct dc is a software-only bookkeeping structure that is never handed +to hardware DMA and is only ever kept as an opaque pointer, so it does +not require physically contiguous memory. Allocate it with kvzalloc() +(and free it with kvfree()) so that the allocator can fall back to +vmalloc() when a contiguous allocation of that size is not available, +which also avoids the MAX_PAGE_ORDER warning entirely. + +v2: + - Rebase to amd-staging-drm-next. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5406 +Reviewed-by: Mario Limonciello (AMD) +Signed-off-by: Honglei Huang +Signed-off-by: Alex Deucher +(cherry picked from commit 991e0516a8072f2292681c6ae98a924ab0e32575) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -1507,7 +1507,7 @@ static void disable_vbios_mode_if_requir + + struct dc *dc_create(const struct dc_init_data *init_params) + { +- struct dc *dc = kzalloc_obj(*dc); ++ struct dc *dc = kvzalloc_obj(*dc); + unsigned int full_pipe_count; + + if (!dc) +@@ -1555,7 +1555,7 @@ struct dc *dc_create(const struct dc_ini + + destruct_dc: + dc_destruct(dc); +- kfree(dc); ++ kvfree(dc); + return NULL; + } + +@@ -1604,7 +1604,7 @@ void dc_deinit_callbacks(struct dc *dc) + void dc_destroy(struct dc **dc) + { + dc_destruct(*dc); +- kfree(*dc); ++ kvfree(*dc); + *dc = NULL; + } + diff --git a/queue-7.1/drm-amdgpu-add-the-doorbell-index-input-for-suspending-userq.patch b/queue-7.1/drm-amdgpu-add-the-doorbell-index-input-for-suspending-userq.patch new file mode 100644 index 0000000000..72d53a28ed --- /dev/null +++ b/queue-7.1/drm-amdgpu-add-the-doorbell-index-input-for-suspending-userq.patch @@ -0,0 +1,43 @@ +From b181bf68d11f034efe27ae1377a0f659605f040f Mon Sep 17 00:00:00 2001 +From: Prike Liang +Date: Wed, 17 Jun 2026 14:20:16 +0800 +Subject: drm/amdgpu: add the doorbell index input for suspending userq +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Prike Liang + +commit b181bf68d11f034efe27ae1377a0f659605f040f upstream. + +It requires inputing the doorbell offset for MES firmware preempts the +userq, and adding the doorbell offset also keep aliging with the +union MESAPI__SUSPEND in MES firmware. + +Signed-off-by: Prike Liang +Acked-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit bc434335ab3c096a33a9e88c7951b4ac574db458) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h +@@ -288,12 +288,14 @@ struct mes_suspend_gang_input { + uint64_t gang_context_addr; + uint64_t suspend_fence_addr; + uint32_t suspend_fence_value; ++ uint32_t doorbell_offset; + }; + + struct mes_resume_gang_input { + uint32_t xcc_id; + bool resume_all_gangs; + uint64_t gang_context_addr; ++ uint32_t doorbell_offset; + }; + + struct mes_reset_queue_input { diff --git a/queue-7.1/drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch b/queue-7.1/drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..a28e9592ad --- /dev/null +++ b/queue-7.1/drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch @@ -0,0 +1,40 @@ +From 9e98ed3113943257ad6e5c1e6beddbdb482a70ad Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:26:28 -0400 +Subject: drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit 9e98ed3113943257ad6e5c1e6beddbdb482a70ad upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +@@ -527,7 +527,7 @@ static void sdma_v5_0_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */ + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); +@@ -538,7 +538,7 @@ static void sdma_v5_0_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(seq)); diff --git a/queue-7.1/drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch b/queue-7.1/drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..e35aaf2937 --- /dev/null +++ b/queue-7.1/drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch @@ -0,0 +1,40 @@ +From b9dd618a635d39fbb211454b6e8837b2a7f10fb0 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:27:15 -0400 +Subject: drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit b9dd618a635d39fbb211454b6e8837b2a7f10fb0 upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit ae658afc7f47f6147371ec42cc6b1a793dfdb5af) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c +@@ -377,7 +377,7 @@ static void sdma_v5_2_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */ + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); +@@ -388,7 +388,7 @@ static void sdma_v5_2_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(seq)); diff --git a/queue-7.1/drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch b/queue-7.1/drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..e360fb4f34 --- /dev/null +++ b/queue-7.1/drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch @@ -0,0 +1,40 @@ +From ec42c96c322e5cc48099ab5e67b5cbe236cb1949 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:27:54 -0400 +Subject: drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit ec42c96c322e5cc48099ab5e67b5cbe236cb1949 upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c +@@ -360,7 +360,7 @@ static void sdma_v6_0_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */ + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); +@@ -371,7 +371,7 @@ static void sdma_v6_0_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(seq)); diff --git a/queue-7.1/drm-amdgpu-sdma7.0-replace-bug_on-with-warn_on.patch b/queue-7.1/drm-amdgpu-sdma7.0-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..73f064ef3e --- /dev/null +++ b/queue-7.1/drm-amdgpu-sdma7.0-replace-bug_on-with-warn_on.patch @@ -0,0 +1,40 @@ +From e80e28f398f5d9f6e361ffb56382d2e74fc87556 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:28:29 -0400 +Subject: drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit e80e28f398f5d9f6e361ffb56382d2e74fc87556 upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c +@@ -363,7 +363,7 @@ static void sdma_v7_0_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */ + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); +@@ -374,7 +374,7 @@ static void sdma_v7_0_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(seq)); diff --git a/queue-7.1/drm-i915-hdcp-check-streams-bounds-before-overflow.patch b/queue-7.1/drm-i915-hdcp-check-streams-bounds-before-overflow.patch new file mode 100644 index 0000000000..856829c8db --- /dev/null +++ b/queue-7.1/drm-i915-hdcp-check-streams-bounds-before-overflow.patch @@ -0,0 +1,55 @@ +From bbb15a6b042d02e5508a02b4847e02d2579ee7bc Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Thu, 25 Jun 2026 20:03:04 +0300 +Subject: drm/i915/hdcp: check streams[] bounds before overflow + +From: Jani Nikula + +commit bbb15a6b042d02e5508a02b4847e02d2579ee7bc upstream. + +The data->streams[] overflow check is done after the buffer overflow has +already happened. Move the overflow check before the write. + +Side note, emitting a warning splat with a backtrace might be overkill +here, but prefer not changing the behaviour other than not doing the +overrun. + +Discovered using AI-assisted static analysis confirmed by Intel Product +Security. + +Reported-by: Martin Hodo +Fixes: e03187e12cae ("drm/i915/hdcp: MST streams support in hdcp port_data") +Cc: stable@vger.kernel.org # v5.12+ +Cc: Anshuman Gupta +Cc: Suraj Kandpal +Reviewed-by: Suraj Kandpal +Link: https://patch.msgid.link/20260625170304.1104723-1-jani.nikula@intel.com +Signed-off-by: Jani Nikula +(cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_hdcp.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/display/intel_hdcp.c ++++ b/drivers/gpu/drm/i915/display/intel_hdcp.c +@@ -132,6 +132,9 @@ intel_hdcp_required_content_stream(struc + if (conn_dig_port != dig_port) + continue; + ++ if (drm_WARN_ON(display->drm, data->k >= INTEL_NUM_PIPES(display))) ++ return -EINVAL; ++ + data->streams[data->k].stream_id = + intel_conn_to_vcpi(state, connector); + data->k++; +@@ -142,7 +145,7 @@ intel_hdcp_required_content_stream(struc + } + drm_connector_list_iter_end(&conn_iter); + +- if (drm_WARN_ON(display->drm, data->k > INTEL_NUM_PIPES(display) || data->k == 0)) ++ if (drm_WARN_ON(display->drm, !data->k)) + return -EINVAL; + + /* diff --git a/queue-7.1/drm-i915-hdcp-require-monotonically-increasing-seq_num_v.patch b/queue-7.1/drm-i915-hdcp-require-monotonically-increasing-seq_num_v.patch new file mode 100644 index 0000000000..c02c602775 --- /dev/null +++ b/queue-7.1/drm-i915-hdcp-require-monotonically-increasing-seq_num_v.patch @@ -0,0 +1,50 @@ +From db9e64c983dcb07ff256bd455f258c44aa530ff8 Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Thu, 25 Jun 2026 13:44:07 +0300 +Subject: drm/i915/hdcp: require monotonically increasing seq_num_v + +From: Jani Nikula + +commit db9e64c983dcb07ff256bd455f258c44aa530ff8 upstream. + +The HDCP 2.2 specification requires the seq_num_v to be monotonically +increasing, and repeated seq_num_v needs to be treated as an integrity +failure. Make it so. + +For the first message, seq_num_v must be zero, and is already +checked. We can only check for less-than-or-equal for the subsequent +messages, where hdcp2_encrypted is true. + +Discovered using AI-assisted static analysis confirmed by Intel Product +Security. + +Reported-by: Martin Hodo +Fixes: d849178e2c9e ("drm/i915: Implement HDCP2.2 repeater authentication") +Cc: stable@vger.kernel.org # v5.2+ +Cc: Suraj Kandpal +Reviewed-by: Suraj Kandpal +Link: https://patch.msgid.link/20260625104407.1025614-1-jani.nikula@intel.com +Signed-off-by: Jani Nikula +(cherry picked from commit 58a224375c81179b52558c53d8857b93196d2687) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_hdcp.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_hdcp.c ++++ b/drivers/gpu/drm/i915/display/intel_hdcp.c +@@ -1785,9 +1785,10 @@ int hdcp2_authenticate_repeater_topology + return -EINVAL; + } + +- if (seq_num_v < hdcp->seq_num_v) { +- /* Roll over of the seq_num_v from repeater. Reauthenticate. */ +- drm_dbg_kms(display->drm, "Seq_num_v roll over.\n"); ++ if (hdcp->hdcp2_encrypted && seq_num_v <= hdcp->seq_num_v) { ++ /* Reauthenticate on Seq_num_v repeat or rollover */ ++ drm_dbg_kms(display->drm, "Seq_num_v %s\n", ++ seq_num_v == hdcp->seq_num_v ? "repeat" : "rollover"); + return -EINVAL; + } + diff --git a/queue-7.1/drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch b/queue-7.1/drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch new file mode 100644 index 0000000000..6de9368c5a --- /dev/null +++ b/queue-7.1/drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch @@ -0,0 +1,45 @@ +From f8a9262c7a6fc2de9802e14b0228114f0333869e Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Thu, 25 Jun 2026 16:10:40 +0300 +Subject: drm/i915/vrr: require valid min/max vfreq for VRR + +From: Jani Nikula + +commit f8a9262c7a6fc2de9802e14b0228114f0333869e upstream. + +Ensure the EDID provided min/max vfreq are valid. Most scenarios are +already covered (by coincidence) through the checks in +intel_vrr_is_capable() and intel_vrr_is_in_range(), but be more explicit +about it. At worst, a zero min_vfreq could lead to a division by zero in +intel_vrr_compute_vmax(). + +Discovered using AI-assisted static analysis confirmed by Intel Product +Security. + +Reported-by: Martin Hodo +Fixes: 117cd09ba528 ("drm/i915/display/dp: Compute VRR state in atomic_check") +Cc: stable@vger.kernel.org # v5.12+ +Cc: Ankit Nautiyal +Reviewed-by: Ankit Nautiyal +Link: https://patch.msgid.link/20260625131040.1051272-1-jani.nikula@intel.com +Signed-off-by: Jani Nikula +(cherry picked from commit 1765cf59f517b02f3b0591fe5120930d08bddeb6) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_vrr.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/i915/display/intel_vrr.c ++++ b/drivers/gpu/drm/i915/display/intel_vrr.c +@@ -64,6 +64,10 @@ bool intel_vrr_is_capable(struct intel_c + return false; + } + ++ if (!info->monitor_range.min_vfreq || !info->monitor_range.max_vfreq || ++ info->monitor_range.min_vfreq > info->monitor_range.max_vfreq) ++ return false; ++ + return info->monitor_range.max_vfreq - info->monitor_range.min_vfreq > 10; + } + diff --git a/queue-7.1/drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch b/queue-7.1/drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch new file mode 100644 index 0000000000..aad81f96f1 --- /dev/null +++ b/queue-7.1/drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch @@ -0,0 +1,42 @@ +From 4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Sat, 20 Jun 2026 21:43:34 -0500 +Subject: drm/virtio: bound EDID block reads to the response buffer + +From: Bryam Vargas + +commit 4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd upstream. + +virtio_get_edid_block() validates the read offset only against the +device-supplied resp->size field, never against the fixed-size resp->edid +array. The EDID block index is driven by the device-supplied extension +count, so a malicious virtio-gpu backend can advertise a large size +together with a high block count and read far past the array into adjacent +kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds +read / info leak). + +Also reject any read whose end exceeds the size of the edid array. +Conforming EDID responses stay within the array and are unaffected. + +Fixes: b4b01b4995fb ("drm/virtio: add edid support") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Signed-off-by: Dmitry Osipenko +Link: https://patch.msgid.link/20260620-b4-disp-22bba7bf-v1-1-b95924cee742@proton.me +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/virtio/virtgpu_vq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/virtio/virtgpu_vq.c ++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c +@@ -894,7 +894,8 @@ static int virtio_get_edid_block(void *d + struct virtio_gpu_resp_edid *resp = data; + size_t start = block * EDID_LENGTH; + +- if (start + len > le32_to_cpu(resp->size)) ++ if (start + len > le32_to_cpu(resp->size) || ++ start + len > sizeof(resp->edid)) + return -EINVAL; + memcpy(buf, resp->edid + start, len); + return 0; diff --git a/queue-7.1/revert-drm-amd-display-restore-5s-vbl-offdelay-for-nv3x-dgpus.patch b/queue-7.1/revert-drm-amd-display-restore-5s-vbl-offdelay-for-nv3x-dgpus.patch new file mode 100644 index 0000000000..dcc5c7cfa7 --- /dev/null +++ b/queue-7.1/revert-drm-amd-display-restore-5s-vbl-offdelay-for-nv3x-dgpus.patch @@ -0,0 +1,53 @@ +From f39283eab44fb7e304677b2aa1d8c38f151b6566 Mon Sep 17 00:00:00 2001 +From: Leo Li +Date: Mon, 4 May 2026 14:09:49 -0400 +Subject: Revert "drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs" + +From: Leo Li + +commit f39283eab44fb7e304677b2aa1d8c38f151b6566 upstream. + +Now that proper fixes have been found, let's revert this workaround. + +This reverts commit a1fc7bf6677eb547167cb72b3bcafdc34b976692. + +Tested-by: Mario Limonciello (AMD) +Reviewed-by: Mario Limonciello (AMD) +Signed-off-by: Leo Li +Signed-off-by: Alex Deucher +(cherry picked from commit f64a9be5653689ff43e148cd8a6483077488c8e5) +Cc: stable@vger.kernel.org # 8382cd234981: drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock +Cc: stable@vger.kernel.org # 48ab86360af1: drm/amd/display: check GRPH_FLIP status before sending event +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 18 +++--------------- + 1 file changed, 3 insertions(+), 15 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -9427,21 +9427,9 @@ static void manage_dm_interrupts(struct + if (acrtc_state) { + timing = &acrtc_state->stream->timing; + +- if (amdgpu_ip_version(adev, DCE_HWIP, 0) >= +- IP_VERSION(3, 2, 0) && +- !(adev->flags & AMD_IS_APU)) { +- /* +- * DGPUs NV3x and newer that support idle optimizations +- * experience intermittent flip-done timeouts on cursor +- * updates. Restore 5s offdelay behavior for now. +- * +- * Discussion on the issue: +- * https://lore.kernel.org/amd-gfx/20260217191632.1243826-1-sysdadmin@m1k.cloud/ +- */ +- config.offdelay_ms = 5000; +- config.disable_immediate = false; +- } else if (amdgpu_ip_version(adev, DCE_HWIP, 0) < +- IP_VERSION(3, 5, 0)) { ++ if (amdgpu_ip_version(adev, DCE_HWIP, 0) < ++ IP_VERSION(3, 5, 0) || ++ !(adev->flags & AMD_IS_APU)) { + /* + * Older HW and DGPU have issues with instant off; + * use a 2 frame offdelay. diff --git a/queue-7.1/series b/queue-7.1/series index e94fe4ab42..7ddb2773da 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -418,3 +418,17 @@ drm-amdkfd-check-bounds-in-allocate_event_notification_slot.patch drm-amdkfd-check-bounds-on-criu-restore-queue-type-and-mqd-size.patch drm-amdkfd-fix-32-bit-overflow-in-cwsr-total-size-calculation.patch drm-amdkfd-free-mqd-managers-on-dqm-init-failures.patch +drm-amd-display-set-msa-misc1-bit-6-when-using-vsc-sdp-for-dce-11.x.patch +drm-amd-display-handle-struct-drm_plane_state.ignore_damage_clips.patch +drm-amd-display-use-kvzalloc-to-allocate-struct-dc.patch +drm-amd-display-detect_link_and_local_sink-dp-alt-mode-timeout-path-leaks-prev_sink-reference.patch +revert-drm-amd-display-restore-5s-vbl-offdelay-for-nv3x-dgpus.patch +drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch +drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch +drm-i915-hdcp-require-monotonically-increasing-seq_num_v.patch +drm-i915-hdcp-check-streams-bounds-before-overflow.patch +drm-amdgpu-add-the-doorbell-index-input-for-suspending-userq.patch +drm-amdgpu-sdma7.0-replace-bug_on-with-warn_on.patch +drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch +drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch +drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch