kernel/git/stable/linux.git/drivers/gpu/drm/display, branch master

BackMerge tag 'v7.2' into drm-next

2026-08-20T00:58:44+00:00

Linux 7.2 There was a lot of conflicts this round between fixes and next, and I'd like to get the merge resolutions that we have in drm-tip. Signed-off-by: Dave Airlie

drm/connector/hdmi: Fix out of bounds memory read

2026-08-10T09:38:57+00:00

A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 28 byte allocation. Fix that by using the source size instead, together with a build bug on the source size actually being smaller than the destination. I hit this running KUnit tests under KASAN (while debugging something else entirely). In the real world, it seems unlikely to cause an actual problem. It is a read not a write so it can't corrupt any memory. However, it could potentially fall off the end of a page and cause an accvio bug. Fixes: f378b77227bc ("drm/connector: hdmi: Add Infoframes generation") Cc: Ville Syrjälä Cc: Dmitry Baryshkov Cc: Maxime Ripard Cc: Maarten Lankhorst Cc: Thomas Zimmermann Cc: David Airlie Cc: Simona Vetter Cc: Dmitry Baryshkov Cc: Daniel Stone Cc: Nicolas Frattaroli Cc: Jani Nikula Cc: José Expósito Cc: Laurent Pinchart Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org # v6.11+ Signed-off-by: John Harrison Link: https://patch.msgid.link/20260723220652.533345-1-John.Harrison@Igalia.com Signed-off-by: Maxime Ripard

Merge tag 'drm-intel-next-2026-07-28' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next

2026-07-31T20:05:01+00:00

drm/i915 feature pull #2 for v7.3: Features and functionality: - Enable UHBR link rates on Thunderbolt tunneled links (Imre) - Reduce Xe3+ PM demand peak bandwidth for power savings (Vinod) - Add the blend mode property to all planes that support alpha blending (Chaitanya) - Enable pipe DMC error interrupts for display 30+ (Dibin) - Add KUnit tests for DP link config selection and fallback (Imre) Refactoring and cleanups: - Refactor DP link config selection and unify across use cases (Imre) - Unify i915 and xe display runtime PM calls (Jani) - Refactor BIOS framebuffer takeover (Ville) Fixes: - Fix HD audio on DP UHBR SST (Kai Vehmanen) - Fixes to xe driver BIOS framebuffer takeover (Ville) - Fix 2 pixels-per-clock CDCLK calculation to avoid underruns (Ville) - Fix incorrectly set VSC SDP Main Stream Attribute (Chaitanya) - Fix BPC and DSC selection for HDMI sinks (Alexander Kaplan) - Fix PCON max FRL rate selection (Alexander Kaplan) - Workaround Xe3P PSR2 screen corruption (Dibin) - Fix NVL A & B stepping vtotal setting (Suraj) - Fix xe DPT allocation paths (Maarten) - Prefer system memory instead of stolen for new framebuffers in xe (Maarten) - Fix transcoder mask sizes (John Harrison) - Clear stale UV/Y plane DDB entries on plane disable (Vinod) - Fix some DP AUX backlight control issues, again (Suraj) - Fix switching between HDCP 1.4 and 2.2 authentication (Suraj) - Remove unnecessary Xe2_LPD+ FBC plane width and surface size limits (Vinod) - Ensure non-zero DSB safe window for PTL+ (Ankit) - Fix bandwidth calculation to account for 16 DRAM channels (Uma) - Fix NV12 ceiling division for bigjoiner case (Vidya) DRM core changes: - Add Thunderbolt UHBR tunneling support (Imre) Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patch.msgid.link/cb1b5a644d75589cbcdcc8ec8160968140426439@intel.com

drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs

2026-07-29T12:01:31+00:00

The PCON max FRL bandwidth field lives in byte 2 of the DFP Detailed Capability Info (DPCD 0x82 for the first DFP). The DP standard defines the meaning of descriptor bytes 1-3 strictly per DFP type, and for a DisplayPort type DFP all of them are reserved, with "read all 0s" semantics (DP v2.0, section 2.12.3, Table 2-183). The FRL bandwidth field is an HDMI DFP extension added by the VESA DP-to-HDMI PCON specification. drm_dp_get_pcon_max_frl_bw() however parses the byte without checking the DFP type, the branch presence or DETAILED_CAP_INFO_AVAILABLE. Without the latter the port descriptors are one byte wide and port_cap[2] is not even the right register. All neighbouring helpers parsing the same descriptor are scoped by the DFP type already, see for instance drm_dp_downstream_max_bpc() reading the same byte and returning 0 for a DP type DFP. amdgpu's DC parses the field only for HDMI(/DP++) detailed types as well. This is not theoretical. A Synaptics VMM7100 based USB-C to HDMI adapter with a macOS targeted firmware advertises a DisplayPort type DFP with the type byte replicated across the whole descriptor (08 08 08 08). i915 decodes that as "PCON limited to 18 Gbps FRL" and prunes every mode above ~750 MHz dotclock, including all the 4k@100/120 modes the sink EDID offers, while macOS drives 4k@120 through the same adapter just fine via DP DSC (and amdgpu's type-scoped parser would ignore the bogus field as well). Only parse the field for an HDMI DFP behind a DPCD 1.1+ branch device that reports detailed cap info, matching the type-scoped field layout of the spec and the rest of the helpers. Fixes: ce32a6239de6 ("drm/dp_helper: Add Helpers for FRL Link Training support for DP-HDMI2.1 PCON") Cc: Ankit Nautiyal Cc: Uma Shankar (v2) Cc: Jani Nikula Cc: Maarten Lankhorst Cc: dri-devel@lists.freedesktop.org Cc: # v5.12+ Signed-off-by: Alexander Kaplan Reviewed-by: Ankit Nautiyal Signed-off-by: Ankit Nautiyal Link: https://patch.msgid.link/20260610193825.2933-1-alexander.kaplan@sms-medipool.de

drm/dp_tunnel: Add UHBR tunneling support

2026-07-20T12:46:08+00:00

Add the DPCD registers and detection required to support UHBR link rates over Thunderbolt tunnels. Cc: dri-devel@lists.freedesktop.org Reviewed-by: Suraj Kandpal Acked-by: Maarten Lankhorst Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260714152700.555527-2-imre.deak@intel.com

drm/bridge: rename drm_for_each_bridge_in_chain_scoped() to drm_for_each_bridge_in_chain()

2026-07-14T15:55:51+00:00

drm_for_each_bridge_in_chain_scoped() was added in commit e46efc6a7d28 ("drm/bridge: add drm_for_each_bridge_in_chain_scoped()") to provide a safer alternative to drm_for_each_bridge_in_chain(). Following commits converted all users to the _scoped variant. Finally commit 2f08387a444c ("drm/bridge: remove drm_for_each_bridge_in_chain()") removed the old drm_for_each_bridge_in_chain() macro. It's time to rename drm_for_each_bridge_in_chain_scoped() back to the original name. Reviewed-by: Louis Chauvet Link: https://patch.msgid.link/20260630-drm-bridge-alloc-getput-for_each_bridge-2-v2-1-e0a1094cd1eb@bootlin.com Signed-off-by: Luca Ceresoli

Merge tag 'drm-misc-next-2026-06-19' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-07-06T07:38:49+00:00

drm-misc-next for 7.3: UAPI Changes: - connector: Add color format property Cross-subsystem Changes: - dmem: introduce a peak file Core Changes: - atomic: Add create_state callback and helpers to all objects, add documentation on atomic commit lifetime - buddy: Fix use-after-free, add per-order free and used block scoreboards - gem: Remove DRIVER_GEM_GPUVA feature flag - hdmi: Hook the color format property in the helpers - mipi-dsi: Add MIPI_DSI_MODE_DSC_ALL_SLICES_IN_PKT flag - sched: Add test suite for concurrent job submissions - virtio: Add support for saving and restoring virtio_gpu_objects, abort virtqueue wait on device removal to avoid hung task Driver Changes: - amdgpu: Implement "color format" DRM property - amdxdna: Disable device buffer exporting - ethosu: Add performance counter support - msm: Support DSC configurations with slice_per_pkt > 1 - mxsfb: Fix disable sequence - panthor: Support sparse mappings - rockchip: Support YUV background color, Fix layer config timeout, add edp support for rk3576, cleanups and formats improvements - solomon: Add a batch command submission function - tegra: Add DSI support for Tegra 20 and 30, fix dsi driver when the firmware hasn't enabled the controller, - v3d: Reduce PM runtime autosuspend delay, Scheduler and submission fixes and refactoring, Deprecate V3D 3.3 and 4.1 support - bridge: - display-connector: don't autoenable HPD IRQ, trigger initial HPD event for DP - dw-dp: Null pointer dereference and use-after-free fixes - ti-sn65dsi83: Remove NO_HFP and NO_HBP mode flags - panel: - himax-hx83121a: add backlight regulator support - novatek-nt36672a: Inline panel init sequences - panel-edp: Add quirks for AUO B116XAT04.3, CMN N116BCP-EA2, CSW MNB601LS1-8, BOE NV116WH2-M30, BOE NT116WHM-N21, BOE NV116FH1-M31, BOE NV116FH1-M30, NV140FHM-N5B, TM156VDXP25 - New panels: Samsung ATNA40HQ08-0, Anbernic TD4310, Chipone ICNA35XX, Ilitek ILI9488 Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260619-burgundy-termite-of-whirlwind-f7a4dd@houat

drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()

2026-07-01T10:07:10+00:00

A hotplug or link-loss event can tear down the MST topology (setting mgr->mst_state = false and mgr->mst_primary = NULL) concurrently with a caller invoking drm_dp_mst_topology_queue_probe(). Since the check is already performed under mgr->lock, the condition is not a programming error but a valid race -- the topology was valid when the caller decided to call this function, but was torn down before the lock was acquired. Replace the drm_WARN_ON() with a graceful early return. This eliminates spurious kernel warnings and the resulting compositor crashes observed when connecting/disconnecting DP MST monitors, while keeping the correct behavior of doing nothing when MST is not active. A drm_dbg_mst() trace is added so the skipped probe remains observable under MST debug logging. The existing WARN_ON(mgr->mst_primary) in drm_dp_mst_topology_mgr_set_mst() already catches the case where the topology is initialized twice, so no diagnostic coverage is lost. Fixes: dbaeef363ea5 ("drm/dp_mst: Add a helper to queue a topology probe") Cc: Imre Deak Cc: Lyude Paul Cc: stable@vger.kernel.org Cc: intel-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Jonas Emilsson Signed-off-by: Luca Coelho Link: https://lore.kernel.org/all/20260503034533.1023686-1-jonas.emilsson@gmail.com Acked-by: Imre Deak Link: https://patch.msgid.link/20260622140532.526722-1-luciano.coelho@intel.com Signed-off-by: Maarten Lankhorst

drm/display: hdmi-state-helper: Try subsampling in mode_valid

2026-06-09T20:03:51+00:00

drm_hdmi_connector_mode_valid assumes modes are only valid if they work with RGB. The reality is more complex however: YCbCr 4:2:0 chroma-subsampled modes only require half the pixel clock that the same mode would require in RGB. This leads to drm_hdmi_connector_mode_valid rejecting perfectly valid 420-only or 420-also modes. Fix this by checking whether the mode is 420-capable first. If so, then proceed by checking it with DRM_OUTPUT_COLOR_FORMAT_YCBCR420 so long as the connector has legalized 420, otherwise error out. If the mode is not 420-capable, check with RGB as was previously always the case. Fixes: 47368ab437fd ("drm/display: hdmi: add generic mode_valid helper") Reviewed-by: Maxime Ripard Reviewed-by: Dmitry Baryshkov Reviewed-by: Daniel Stone Signed-off-by: Nicolas Frattaroli Link: https://patch.msgid.link/20260609-color-format-v17-9-35739b5782cc@collabora.com Signed-off-by: Daniel Stone

drm/display: hdmi-state-helper: Act on color format DRM property

2026-06-09T20:03:50+00:00

With the introduction of the "color format" DRM property, which allows userspace to request a specific color format, the HDMI state helper should implement this. Implement it by translating the requested drm_connector_color_format to a drm_output_color_format enum value as per the logic HDMI should use for this: Auto is translated to RGB, and a fallback to YUV420 is only performed if the original color format was auto. Reviewed-by: Dmitry Baryshkov Reviewed-by: Maxime Ripard Reviewed-by: Daniel Stone Signed-off-by: Nicolas Frattaroli Link: https://patch.msgid.link/20260609-color-format-v17-8-35739b5782cc@collabora.com Signed-off-by: Daniel Stone