linux-stable.git/drivers/gpu/drm, branch v6.18.50

nouveau/gem: reserve the bo in the info ioctl around the vma lookup

2026-09-07T15:22:40+00:00

commit 5e17160d41d92823f3379c1982e1369680c5ce4d upstream.

In the non-uvmm path, there could be a race between the info lookup
finding the vma, and the gem close path closing the vma leading
to a use-after-free.

Spotted with the help of Opus 4.6.

Signed-off-by: Dave Airlie 
Fixes: e758a3111914 ("drm/nouveau: fixup gem_info ioctl to return client-specific bo virtual")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260612020658.3176270-1-airlied@gmail.com
Signed-off-by: Danilo Krummrich 
Signed-off-by: Greg Kroah-Hartman

drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile

2026-09-07T15:22:20+00:00

[ Upstream commit 7a4dd08c3f921576c6a7524f60e4f0e4601835d2 ]

[why]
The Apple Studio Display primary tile advertises both the full 5120x2880
mode and the per-tile 2560x2880 timing. With the secondary tile already
hidden from userspace, the stray 2560x2880 mode on the primary connector
can still be picked by compositors, defeating the single 5K stream goal.

[how]
Prune the per-tile timing from the primary connector during get_modes:
when the sink carries the disable_second_tile quirk and the connector is
the primary tile (tile_h_loc == 0 && tile_v_loc == 0), drop any probed
mode matching the advertised tile size (tile_h_size x tile_v_size) so
userspace only sees the full 5120x2880 mode.

Fixes: 49521be4809d ("drm/amd/display: hide Apple Studio Display secondary tile")
Reviewed-by: Wayne Lin 
Signed-off-by: Fangzhi Zuo 
Tested-by: Dan Wheeler 
Signed-off-by: Alex Deucher 
Adjust for lack of movement from amdgpu_dm.c to amdgpu_dm_connector.c
Signed-off-by: Mario Limonciello 
Signed-off-by: Sasha Levin

drm/amd/display: hide Apple Studio Display secondary tile

2026-09-07T15:22:20+00:00

[ Upstream commit 49521be4809d63fe3efb6bc68ee11cb1e1ef3d63 ]

The Apple Studio Display exposes a 2x1 tiled panel over two SST DP
links. The primary tile advertises the full 5120x2880 mode (with DSC on
the bandwidth-sufficient link) while the secondary carries a per-tile
2560x2880 timing on a link without sufficient bandwidth. Report the
non-primary tile connector as disconnected during detect so compositors
only see the primary DP link and configure a single 5K mode instead of
driving both tiled streams independently.

Drive the behaviour from an EDID quirk: add a disable_second_tile panel
patch that apply_edid_quirks() sets for the affected Apple Studio
Display panel IDs (0xAE3A, 0xAE42, 0xAE46), and have detect() hide the
secondary tile when the sink carries that quirk.

Reviewed-by: Mario Limonciello 
Reviewed-by: Sun peng Li 
Signed-off-by: Jerry Zuo 
Signed-off-by: Wayne Lin 
Tested-by: Dan Wheeler 
Signed-off-by: Alex Deucher 
Adjust for lack of movement from amdgpu_dm.c to amdgpu_dm_connector.c
Adjust for lack of analog connector support.
Signed-off-by: Mario Limonciello 
Signed-off-by: Sasha Levin

drm/amd/display: Refactor amdgpu_dm_connector_detect (v2)

2026-09-07T15:22:20+00:00

[ Upstream commit 8223a605744bb471f31018eac9075a539415b16f ]

Prepare for polling analog connectors.
Document the function better.

Signed-off-by: Timur Kristóf 
Reviewed-by: Harry Wentland 
Signed-off-by: Alex Deucher 
Signed-off-by: Mario Limonciello 
Signed-off-by: Sasha Levin

drm/amd/display: Skip PHY SSC reduction on some 8K panels

2026-09-07T15:22:20+00:00

[ Upstream commit 144169e7be0831e09958a906d08d1856751aa6c6 ]

[Why]
Some 8K displays cannot tolerate the reduced phy ssc value
at high link utilization and show corruption or black screen.

[How]
Add an EDID panel-id quirk to utilize existing skip_phy_ssc_reduction flag.

To pass the link into the quirk handler, change the signature of
apply_edid_quirks() to take link as an argument. The dev local in
dm_helpers_parse_edid_caps() becomes unused and is removed.

Fixes: 5fa62c87cffd ("drm/amd/display: Add option to disable PHY SSC reduction on transmitter enable")
Reviewed-by: Alex Hung 
Signed-off-by: Roman Li 
Signed-off-by: Aurabindo Pillai 
Tested-by: Dan Wheeler 
Signed-off-by: Alex Deucher 
Adjust for lack of HDMI 2.1 FRL in 6.18.y
Signed-off-by: Mario Limonciello 
Signed-off-by: Sasha Levin

drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths

2026-09-07T15:22:20+00:00

[ Upstream commit 4ae3e16f4b3bf64140f773629b765d605ee079a9 ]

In dc_dmub_srv_log_diagnostic_data() and
dc_dmub_srv_enable_dpia_trace().

Both functions check:

  if (!dc_dmub_srv || !dc_dmub_srv->dmub)

and then call DC_LOG_ERROR() inside that block.

DC_LOG_ERROR() uses dc_dmub_srv->ctx internally. So if
dc_dmub_srv is NULL, the logging itself can dereference a
NULL pointer and cause a crash.

Fix this by splitting the checks.

First check if dc_dmub_srv is NULL and return immediately.
Then check dc_dmub_srv->dmub and log the error only when
dc_dmub_srv is valid.

Fixes the below:
../display/dc/dc_dmub_srv.c:962 dc_dmub_srv_log_diagnostic_data() error: we previously assumed 'dc_dmub_srv' could be null (see line 961)
../display/dc/dc_dmub_srv.c:1167 dc_dmub_srv_enable_dpia_trace() error: we previously assumed 'dc_dmub_srv' could be null (see line 1166)

Fixes: 2631ac1ac328 ("drm/amd/display: add DMUB registers to crash dump diagnostic data.")
Fixes: 71ba6b577a35 ("drm/amd/display: Add interface to enable DPIA trace")
Cc: Roman Li 
Cc: Alex Hung 
Cc: Tom Chung 
Cc: Dan Carpenter 
Cc: Aurabindo Pillai 
Signed-off-by: Srinivasan Shanmugam 
Reviewed-by: Alex Hung 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin

drm/xe/guc_ads: use uncached mapping for UM queue BO

2026-09-02T12:31:46+00:00

commit 8d5134ae4177fa4f5a9bc8e71e6656cfc2852882 upstream.

On Pre-Xe3p platform, the GAM write the UM queue through DPA using UC.
if GuC reads the queue via GGTT (WB), stale data may be observed
when the cacheline has been polluted by another agent.

To match the GAM's UC writes, configure the GuC mapping as UC as well.

Fixes: 9c57bc08652a ("drm/xe/lnl: Drop force_probe requirement")
Cc: Gwan-gyeong Mun 
Cc: Matthew Auld 
Cc:  # v6.12+
Signed-off-by: Jia Yao 
Reviewed by: Matthew Auld 
Signed-off-by: Matthew Auld 
Link: https://patch.msgid.link/20260804165057.129529-4-jia.yao@intel.com
(cherry picked from commit 8d5134ae4177fa4f5a9bc8e71e6656cfc2852882)
Signed-off-by: Thomas Hellström 
Signed-off-by: Sasha Levin

drm/xe/guc_ads: allocate UM queues in VRAM on dGFX

2026-09-02T12:31:46+00:00

commit f342810a141f8a7e8b3786a6e4b6c0695a078a74 upstream.

On iGPU, the UM queue BO is allocated in system memory. On dGFX, the BO
was previously created in system memory and later reallocated in
xe_guc_realloc_post_hwconfig().  Allocate the UM queue BO directly in
VRAM on dGFX, where it is ultimately required.

Fixes: 9c57bc08652a ("drm/xe/lnl: Drop force_probe requirement")
Cc: Gwan-gyeong Mun 
Cc: Matthew Auld 
Cc:  # v6.12+
Signed-off-by: Jia Yao 
Reviewed-by: Matthew Auld 
Signed-off-by: Matthew Auld 
Link: https://patch.msgid.link/20260804165057.129529-3-jia.yao@intel.com
(cherry picked from commit f342810a141f8a7e8b3786a6e4b6c0695a078a74)
Signed-off-by: Thomas Hellström 
Signed-off-by: Sasha Levin

drm/xe/guc_ads: allocate UM queues in a separate BO

2026-09-02T12:31:46+00:00

commit 99b01815957bd7d848420cb697f79ed11f7f215c upstream.

Move the UM queues into a dedicated BO (ads->um_queue_bo) and avoid
CPU memset operations on it, which eliminates the CPU as a potential
cacheline-polluting agent and helps maintain consistency between GAM
writes and GuC reads.

We also need to ensure the base_dpa for the queue is contiguous on hw
where this is used instead of a GGTT address. Another good reason to
split this out to a separate BO.

Fixes: 9c57bc08652a ("drm/xe/lnl: Drop force_probe requirement")
Cc: Gwan-gyeong Mun 
Cc: Matthew Auld 
Cc:  # v6.12+
Signed-off-by: Jia Yao 
Reviewed-by: Matthew Auld 
Signed-off-by: Matthew Auld 
Link: https://patch.msgid.link/20260804165057.129529-2-jia.yao@intel.com
(cherry picked from commit 99b01815957bd7d848420cb697f79ed11f7f215c)
Signed-off-by: Thomas Hellström 
Signed-off-by: Sasha Levin

drm/xe: Fix DPT allocation paths.

2026-08-27T12:32:51+00:00

commit fc648757908304aedbad74f74bf58192aec383db upstream.

Remove the fallback for VRAM to system memory, I tested it and that
doesn't work at all, only a black screen with pipe fault errors were
observed.

On systems with media GT, extra latency is added when accessing stolen
memory when the GT is in MC6. Since we additionally aren't counting how
much memory is used for stolen and we could in theory fill up the
entire stolen area with DPT's, avoid using stolen and only use the
default memory region.

Using stolen may also result in random system hangs under load.

Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7513
Fixes: 775d0adc01a5 ("drm/xe/fbdev: Limit the usage of stolen for LNL+")
Cc:  # v6.12+
Reviewed-by: Matthew Auld 
Link: https://patch.msgid.link/20260630135523.1775379-2-dev@lankhorst.se
Signed-off-by: Maarten Lankhorst 
Acked-by: Matthew Brost  #teams
(cherry picked from commit a196406a3831291598fe8e73245914f7acffdfe0)
Signed-off-by: Thomas Hellström 
[ adapted `pin_params->alignment` to `alignment` and renamed `XE_BO_FLAG_FORCE_WC` to `XE_BO_FLAG_SCANOUT` for the pre-rename flag name ]
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman