Merge tag 'drm-fixes-2026-03-21' of https://gitlab.freedesktop.org/drm/kernelmaster

Pull drm fixes from Dave Airlie:
 "Regular weekly pull request, from sunny San Diego. Usual suspects in
  xe/i915/amdgpu with small fixes all over, then some minor fixes across
  a few other drivers. It's probably a bit on the heavy side, but most
  of the fix seem well contained,

  core:
   - drm_dev_unplug UAF fix

  pagemap:
   - lock handling fix

  xe:
   - A number of teardown fixes
   - Skip over non-leaf PTE for PRL generation
   - Fix an uninitialized variable
   - Fix a missing runtime PM reference

  i915/display:
   - Fix #15771: Screen corruption and stuttering on P14s w/ 3K display
   - Fix for PSR entry setup frames count on rejected commit
   - Fix OOPS if firmware is not loaded and suspend is attempted
   - Fix unlikely NULL deref due to DC6 on probe

  amdgpu:
   - Fix gamma 2.2 colorop TFs
   - BO list fix
   - LTO fix
   - DC FP fix
   - DisplayID handling fix
   - DCN 2.01 fix
   - MMHUB boundary fixes
   - ISP fix
   - TLB fence fix
   - Hainan pm fix

  radeon:
   - Hainan pm fix

  vmwgfx:
   - memory leak fix
   - doc warning fix

  imagination:
   - deadlock fix
   - interrupt handling fixes

  dw-hdmi-qp:
   - multi channel audio fix"

* tag 'drm-fixes-2026-03-21' of https://gitlab.freedesktop.org/drm/kernel: (40 commits)
  drm/xe: Fix missing runtime PM reference in ccs_mode_store
  drm/xe: Open-code GGTT MMIO access protection
  drm/xe/lrc: Fix uninitialized new_ts when capturing context timestamp
  drm/xe/oa: Allow reading after disabling OA stream
  drm/xe: Skip over non leaf pte for PRL generation
  drm/xe/guc: Ensure CT state transitions via STOP before DISABLED
  drm/xe: Trigger queue cleanup if not in wedged mode 2
  drm/xe: Forcefully tear down exec queues in GuC submit fini
  drm/xe: Always kill exec queues in xe_guc_submit_pause_abort
  drm/xe/guc: Fail immediately on GuC load error
  drm/i915/gt: Check set_default_submission() before deferencing
  drm/radeon: apply state adjust rules to some additional HAINAN vairants
  drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
  drm/amdgpu: rework how we handle TLB fences
  drm/bridge: dw-hdmi-qp: fix multi-channel audio output
  drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
  drm/amdgpu: Fix ISP segfault issue in kernel v7.0
  drm/amdgpu/gmc9.0: add bounds checking for cid
  drm/amdgpu/mmhub4.2.0: add bounds checking for cid
  drm/amdgpu/mmhub4.1.0: add bounds checking for cid
  ...

1 files changed, 4 insertions, 6 deletions

diff --git a/drivers/gpu/drm/xe/xe_ggtt.c b/drivers/gpu/drm/xe/xe_ggtt.c
index 2bda426a6986..d1561ebe4e56 100644
--- a/drivers/gpu/drm/xe/xe_ggtt.c
+++ b/drivers/gpu/drm/xe/xe_ggtt.c
@@ -313,6 +313,8 @@ static void dev_fini_ggtt(void *arg)
 {
 	struct xe_ggtt *ggtt = arg;
 
+	scoped_guard(mutex, &ggtt->lock)
+		ggtt->flags &= ~XE_GGTT_FLAGS_ONLINE;
 	drain_workqueue(ggtt->wq);
 }
 
@@ -377,6 +379,7 @@ int xe_ggtt_init_early(struct xe_ggtt *ggtt)
 	if (err)
 		return err;
 
+	ggtt->flags |= XE_GGTT_FLAGS_ONLINE;
 	err = devm_add_action_or_reset(xe->drm.dev, dev_fini_ggtt, ggtt);
 	if (err)
 		return err;
@@ -410,13 +413,10 @@ static void xe_ggtt_initial_clear(struct xe_ggtt *ggtt)
 static void ggtt_node_remove(struct xe_ggtt_node *node)
 {
 	struct xe_ggtt *ggtt = node->ggtt;
-	struct xe_device *xe = tile_to_xe(ggtt->tile);
 	bool bound;
-	int idx;
-
-	bound = drm_dev_enter(&xe->drm, &idx);
 
 	mutex_lock(&ggtt->lock);
+	bound = ggtt->flags & XE_GGTT_FLAGS_ONLINE;
 	if (bound)
 		xe_ggtt_clear(ggtt, node->base.start, node->base.size);
 	drm_mm_remove_node(&node->base);
@@ -429,8 +429,6 @@ static void ggtt_node_remove(struct xe_ggtt_node *node)
 	if (node->invalidate_on_remove)
 		xe_ggtt_invalidate(ggtt);
 
-	drm_dev_exit(idx);
-
 free_node:
 	xe_ggtt_node_fini(node);
 }