linux.git/drivers/gpu/drm/amd/display/amdgpu_dm, branch v7.1

Merge tag 'drm-misc-fixes-2026-06-12' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

2026-06-12T21:52:40+00:00

Short summary of fixes pull:

amd:
- track colorop changes correctly

amdxdna:
- fix possible leak of mm_struct

colorop:
- make lut interpolation mutable
- track colorop updates correctly

ivpu:
- fix integer truncation

vc4:
- fix leak in krealloc() error handling

virtio:
- fix dma_fence ref-count leak

Signed-off-by: Dave Airlie 

From: Thomas Zimmermann 
Link: https://patch.msgid.link/20260612081418.GA17001@2a02-2455-9062-2500-e496-5a17-62ba-545e.dyn6.pyur.net

drm/amd/display: use plane color_mgmt_changed to track colorop changes

2026-06-10T10:13:37+00:00

Ensure the driver tracks changes in any colorop property of a plane
color pipeline by using the same mechanism of CRTC color management and
update plane color blocks when any colorop property changes. It fixes an
issue observed on gamescope settings for night mode which is done via
shaper/3D-LUT updates.

Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block")
Reviewed-by: Harry Wentland 
Reviewed-by: Alex Hung 
Signed-off-by: Melissa Wen 
Signed-off-by: Melissa Wen 
Link: https://patch.msgid.link/20260609110420.1298352-5-mwen@igalia.com

drm/amd/display: Consult MCCS FreeSync cap only if requested & supported

2026-06-04T20:00:11+00:00

When the do_mccs parameter is false, we don't call
dm_helpers_read_mccs_caps, so sink->mccs_caps.freesync_supported is
unlikely to be true.

Fixes: 6f71d5dd3206 ("drm/amd/display: Read sink freesync support via mccs")
Bug: https://gitlab.freedesktop.org/drm/amd/-/work_items/5286
Signed-off-by: Michel Dänzer 
Signed-off-by: Alex Deucher 
(cherry picked from commit 115bf5ca318e18a3dc1888ec6271c7052774952a)

drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs

2026-06-03T18:44:13+00:00

[Why & How]
dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc
without checking for NULL. A connector can be connected but not bound to
any CRTC (e.g. after hot-plug before the next atomic commit), causing a
kernel crash when writing to the sdp_message debugfs node.

The function also ignores the user-provided size argument and always
passes 36 bytes to copy_from_user(), reading past the user buffer when
size < 36.

Fix both issues by:
- Returning -ENODEV when connector->base.state or state->crtc is NULL
- Clamping write_size to min(size, sizeof(data))

Fixes: c7ba3653e977 ("drm/amd/display: Generic SDP message access in amdgpu")
Assisted-by: Copilot:claude-opus-4.6
Reviewed-by: Alex Hung 
Signed-off-by: Harry Wentland 
Signed-off-by: Ray Wu 
Tested-by: Daniel Wheeler 
Signed-off-by: Alex Deucher 
(cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300)
Cc: stable@vger.kernel.org

drm/amd/display: Use EDID from VBIOS embedded panel info

2026-04-29T14:41:46+00:00

When an embedded panel has no DDC, read the EDID from
the VBIOS embedded panel info and use that.

Fixes: 7c7f5b15be65 ("drm/amd/display: Refactor edid read.")
Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192
Signed-off-by: Timur Kristóf 
Signed-off-by: Alex Deucher 
(cherry picked from commit 399b9abc353c62f6e37d38325edbdb6c2c00411c)

drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs

2026-04-29T14:40:44+00:00

[Why]

Rapid vblank off is causing flip-done timeouts for NV3x and newer
family of GPUs that support more idle optimization features.

A proper fix requires further investigation. In lieu of it, let's
workaround it for now.

[How]

For NV3x and newer family of DGPUs, restore the old 5s vblank off timer.

Fixes: 9b47278cec98 ("drm/amd/display: temp w/a for dGPU to enter idle optimizations")
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3787
Link: https://lore.kernel.org/amd-gfx/20260217191632.1243826-1-sysdadmin@m1k.cloud/
Tested-by: Michele Palazzi 
Reviewed-by: Mario Limonciello 
Signed-off-by: Leo Li 
Signed-off-by: Alex Deucher 
(cherry picked from commit df482c2d441b090161633566b7a0755f1bbd55c2)

drm/amd/display: properly handle family setting for early GC 11.5.4

2026-04-28T19:51:17+00:00

Early variants need an override.

Fixes: 57d00816c6a9 ("drm/amdgpu: set family for GC 11.5.4")
Cc: Pratik Vishwakarma 
Cc: Roman Li 
Cc: Mario Limonciello 
Reviewed-by: Mario Limonciello (AMD) 
Tested-by: Mario Limonciello (AMD) 
Signed-off-by: Alex Deucher 
(cherry picked from commit 922fccc2d3f8186008c19ba08a49ae8a9463cb50)

drm/amd/display: Undo accidental fix revert in amdgpu_dm_ism.c

2026-04-21T21:02:45+00:00

[Why]

Pausing DPM power profiles during static screen caused a bunch of
audio/performance/clock issues that were addressed in this fix:
'commit 1412482b7143 ("Revert "drm/amd/display: pause the workload setting in dm"")'

This logic in function amdgpu_dm_crtc_vblank_control_worker() was moved
to amdgpu_dm_ism.c, but the fix was lost in the process.

[How]

Reapply the fix to amdgpu_dm_ism.c

Fixes: 754003486c3c ("drm/amd/display: Add Idle state manager(ISM)")
Reviewed-by: Alex Deucher 
Reviewed-by: Mario Limonciello (AMD) 
Signed-off-by: Leo Li 
Signed-off-by: Alex Deucher 
(cherry picked from commit bc621e91d6fc004cfae9148c5a91acad19ada3e4)

drm/amd/display: Fix ISM teardown crash from NULL dc dereference

2026-04-17T19:40:04+00:00

The Idle State Manager (ISM) uses delayed work to apply display idle
optimizations later, instead of immediately. This helps avoid rapid idle
transitions that can hurt power or performance.

A crash was seen during driver teardown. The system boots normally and
the driver loads successfully. Later, when the GPU is being stopped, the
log shows:

  amdgpu 0000:0e:00.0: finishing device.
  Workqueue: events_unbound dm_ism_sso_delayed_work_func [amdgpu]

After this, delayed ISM work still runs and reaches:

  dm_ism_sso_delayed_work_func()
    -> amdgpu_dm_ism_commit_event()
    -> dm_ism_commit_idle_optimization_state()
    -> dc_allow_idle_optimizations_internal()

The crash report showed:
  KASAN: null-ptr-deref in range [0x690-0x697]

Signature:
	[22601.113316] KASAN: null-ptr-deref in range [0x0000000000000690-0x0000000000000697]
	...
	[22601.113368] Workqueue: events_unbound dm_ism_sso_delayed_work_func [amdgpu]
	[22601.113930] RIP: 0010:dc_allow_idle_optimizations_internal+0xa6/0xc40 [amdgpu]
	...
	[22601.114491] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000690
	...
	[22601.114561] Call Trace:
	[22601.114566]  
	[22601.114572]  ? srso_alias_return_thunk+0x5/0xfbef5
	[22601.114582]  ? update_load_avg+0x1b6/0x20b0
	[22601.114593]  ? __pfx_dc_allow_idle_optimizations_internal+0x10/0x10 [amdgpu]
	[22601.114932]  ? psi_group_change+0x4ed/0x8d0
	[22601.114942]  dm_ism_commit_idle_optimization_state+0x214/0x570 [amdgpu]
	[22601.115268]  amdgpu_dm_ism_commit_event+0xe1d/0x15a0 [amdgpu]
	[22601.115588]  ? srso_alias_return_thunk+0x5/0xfbef5
	[22601.115595]  ? __kasan_check_write+0x18/0x20
	[22601.115603]  ? srso_alias_return_thunk+0x5/0xfbef5
	[22601.115610]  ? mutex_lock+0x83/0xc0
	[22601.115620]  dm_ism_sso_delayed_work_func+0x64/0x90 [amdgpu]

GDB resolved dc_allow_idle_optimizations_internal+0xa6 to:

  struct dc_state *context = dc->current_state;

The matching disassembly showed:

  mov %rdi, %r12
  mov 0x690(%r12), %r13

where r12 holds the dc pointer. A GDB layout dump of struct dc showed:

  /* 1680 | 8 */ struct dc_state *current_state;

Since 1680 decimal is 0x690, this confirms that current_state is at
offset 0x690. The faulting access was effectively:

  dc + 0x690

which indicates that dc was NULL at the time of dereference.

This shows that ISM work can still run during teardown after dc has
been cleared.

ISM is not expected to run after dc is destroyed. Fix this by disabling
ISM under dc_lock in amdgpu_dm_fini() before dc_destroy(), ensuring no
further ISM work runs after dc teardown.

Also add ASSERT(dm->dc) in amdgpu_dm_ism_commit_event() to enforce this
invariant, and ASSERT(mutex_is_locked(&dm->dc_lock)) in
amdgpu_dm_ism_disable() to clarify the locking requirement.

Fixes: 754003486c3c ("drm/amd/display: Add Idle state manager(ISM)")
Suggested-by: Leo Li 
Cc: Ray Wu 
Cc: Roman Li 
Cc: Alex Hung 
Cc: Tom Chung 
Cc: Harry Wentland 
Cc: Aurabindo Pillai 
Cc: Mario Limonciello (AMD) 
Signed-off-by: Srinivasan Shanmugam 
Reviewed-by: Leo Li 
Signed-off-by: Alex Deucher

drm/amd/display: Use overlay cursor when color pipeline is active

2026-04-17T19:23:43+00:00

Force overlay cursor mode when an underlying plane has a non-bypassed
color pipeline to avoid incorrect cursor transformation.

Reviewed-by: Sun peng (Leo) Li 
Signed-off-by: Alex Hung 
Signed-off-by: Aurabindo Pillai 
Tested-by: Dan Wheeler 
Signed-off-by: Alex Deucher