summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
8 daysdrm/amd/display: Make sure streamclk gating is off when enabling streamclkCharlene Liu
[Why & How] streamclk gating sequence update: disable streamclk gating when using streamclk Reviewed-by: Leo Chen <leo.chen@amd.com> Signed-off-by: Charlene Liu <Charlene.Liu@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Cover EDID CEA parsing helpersBhawanpreet Lakha
[Why & How] Add KUnit coverage for the EDID CEA extension parsing helpers dm_edid_parser_send_cea(), parse_edid_cea_dmcu(), parse_edid_cea_dmub() and parse_edid_cea(). Tests exercise the oversized-chunk rejection and DMUB-unavailable paths of the send helper, the DMCU ack/VSDB branches via a mock dmcu_funcs table, the DMUB empty/send-fail branches, and both routing branches of parse_edid_cea(). Assisted-by: Copilot:Claude-Opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Cover dm_restore_drm_connector_stateBhawanpreet Lakha
[Why & How] Add KUnit tests exercising every guard branch of dm_restore_drm_connector_state(): the writeback short-circuit, a missing dc_sink, a NULL connector atomic state, a NULL encoder, a crtc state without a dc stream, and an unchanged sink that skips the forced atomic commit. Assisted-by: Copilot:Claude-Opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/ttm: apply the swapout bulk_move fix to the intended conditionVadim Nikitushkin
Commit 3db7d7d58341 ("drm/ttm: fix swapped-out resources never leaving their bulk_move range") landed in drm-misc-fixes with its one-line change applied to the wrong "if": the "if (ret)" after ttm_resource_try_charge() in ttm_bo_alloc_at_place() became "if (ret > 0)", while the "if (!ret)" after ttm_tt_swapout() in ttm_bo_swapout_cb() that the patch targeted was left untouched. ttm_resource_try_charge() returns 0 or a negative error code, so with "ret > 0" a failed dmem cgroup charge no longer fails the allocation. Restore that check and apply the intended change: ttm_tt_swapout() returns the number of pages swapped out on success, so the bulk_move removal must run for ret > 0. Fixes: 3db7d7d58341 ("drm/ttm: fix swapped-out resources never leaving their bulk_move range") Cc: stable@vger.kernel.org # v7.1+ Signed-off-by: Vadim Nikitushkin <bub4z0r@gmail.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Christian König <christian.koenig@amd.com> Link: https://lore.kernel.org/r/20260910143451.65853-1-bub4z0r@gmail.com
8 daysdrm/amd/display: Test atomic validation guardsAlex Hung
[Why] Add KUnit tests for an empty amdgpu_dm_atomic_check(), an unchanged CRTC update, and a detached plane update. [How] Use standard DRM KUnit objects and existing state fixtures so each helper reaches its software-only early return without DC hardware programming. Assisted-by: Copilot:Claude-Opus-5 GPT-5.6 Sol Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Test writeback state transitionsAlex Hung
[Why] Add KUnit tests for dm_clear_writeback() removing stream writeback state and dm_set_writeback() leaving a job unarmed when no DC pipe matches. [How] Use the real DC removal helper with a state-only update_bandwidth fake, and construct the minimal DRM writeback objects needed to reach the no-pipe cleanup path. Assisted-by: Copilot:Claude-Opus-5 GPT-5.6 Sol Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Add stressed peak bandwidth probe with DMA contentionWenjing Liu
[Why] Peak-bandwidth-under-contention validation currently needs an external tool to manufacture memory contention while querying peak bandwidth. Expose this as an explicit probe variant so the driver can generate that contention itself. [How] Add a new probe type that builds the same gated perfmon sequence as the plain peak-BW probe, with a DMA copy of the current surface into a scratch buffer inserted before the measurement window to synthesize a competing memory client. Move the scratch buffer fields onto the base resource pool struct instead of an ASIC-specific subclass, and reject the probe with a new status code when the buffer was never allocated. Also fixes a stack- corruption bug where a local variable's address was captured by a deferred callback and used after the local went out of scope, and a missing NULL check on a similar output parameter used by an early-return path. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Test cached suspend stateAlex Hung
[Why] Add KUnit tests for dm_cache_state() covering successful caching on an empty DRM device and propagation of an atomic suspend error. [How] Use the standard DRM KUnit device for the success path and the shared DM ops table to inject the suspend failure. Assisted-by: Copilot:Claude-Opus-5 GPT-5.6 Sol Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Test MST resume guardsAlex Hung
[Why] Add KUnit tests for resume_mst_branch_status() without a primary branch and s3_handle_mst() with an empty connector list. [How] Use the real topology mutex and DRM connector iterator. The tests stop before AUX or topology-manager hardware operations are required. Assisted-by: Copilot:Claude-Opus-5 GPT-5.6 Sol Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Test plane update adapterAlex Hung
[Why] Add KUnit tests for update_planes_and_stream_adapter() covering descending plane sorting, argument forwarding, call ordering, and DC failure propagation. [How] Extend the existing DM KUnit ops table with the two DC calls and use spies to observe inputs and ordering. Reuse one ops installer for the adapter and MMHUB tests. Assisted-by: Copilot:Claude-Opus-5 GPT-5.6 Sol Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Add override for LSDMA BW in QoS tableAlvin Lee
[Why & How] Since PMFW does not yet populate LSDMA BW with correct values, add an override interface for debug purposes until values are populated correctly by PMFW. Reviewed-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Test GPU reset helpersAlex Hung
[Why] Add KUnit tests for dm_gpureset_toggle_interrupts() on DCN, amdgpu_dm_commit_zero_streams() on an already empty DC state, and dm_destroy_cached_state() without a cached state. [How] GRPH_PFLIP is unused on DCN, so only the vupdate interrupt is toggled and no interrupt service is needed. An unchanged empty stream list makes dc_commit_streams() return early. Assisted-by: Copilot:Claude-Opus-5 GPT-5.6 Sol Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Test self refresh entryAlex Hung
[Why] Add KUnit tests for amdgpu_dm_enable_self_refresh(), covering the full update and unsupported link blocks, the skip count gating, the damage settle window, and a Replay capable link. [How] The power module stays NULL, which every mod_power entry point treats as a no-op, so the event updates can be reached without a live power module. Assisted-by: Copilot:Claude-Opus-5 GPT-5.6 Sol Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Shorten hdmi_frl_status_polling_workqueueNathan Chancellor
There is a warning when creating the hdmi_frl_status_polling_wq workqueue because "hdmi_frl_status_polling_workqueue" excceds WQ_NAME_LEN: workqueue: name exceeds WQ_NAME_LEN. Truncating to: hdmi_frl_status_polling_workque Shorten the workqueue name to "hdmi_frl_status_polling_wq" like the structure member to avoid the warning. Fixes: 5c9b8b27a883 ("drm/amd/display: Tie FRL support into amdgpu_dm") Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Link: https://patch.msgid.link/20260618-amdgpu-fix-wq_name_len-warning-v2-1-ef0e2e6f5be7@kernel.org Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Test vblank IRQ handlingAlex Hung
[Why] Add KUnit tests for manage_dm_interrupts(), covering the off delay derived from the stream timing, the 30ms fallback, the DCN3.5 APU instant off, and the vblank disable path. [How] The IRQ subsystem is not installed, so amdgpu_irq_get() and amdgpu_irq_put() only report the missing source; the point is that the affected DCN versions request it at all. Assisted-by: Copilot:Claude-Opus-5 GPT-5.6 Sol Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Refactor DC_SEND_CURSOR_INFO_TO_DMU to drop pipe_ctxTomasz Siemek
[Why] Pipe_ctx shouldn't be passed as block sequence parameter. [How] Pass needed parameters explicitly to executor. Reviewed-by: Ilya Bakoulin <ilya.bakoulin@amd.com> Signed-off-by: Tomasz Siemek <tomasz.siemek@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Ensure requested LSDMA BW is within the SOP boundAlvin Lee
[Why & How] - When calculating the required LSDMA bandwidth, it must be capped to the global maximum LSDMA BW. - Also check the calculated bandwidth against what is available in the SOP - Rework code to only compute alt-ch params if alt-ch is in use - Also remove some unused fields - Fix whitespace errors Reviewed-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/display: Force min DCFCLK on AC for DCN42BGabe Teeger
[Why] This is a temporary workaround to address underflows at 4k144 with DCFCLK set to 200MHz. [How] Set the DCFCLK minimum frequency to 300MHz when in AC mode. Signed-off-by: Gabe Teeger <gabe.teeger@amd.com> Signed-off-by: Matthew Stewart <Matthew.Stewart2@amd.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdm/amdgpu: fix malformed link_settings debugfs outputHarry Wentland
[Why] dp_link_settings_read() passed strlen() of each format string as the size argument to snprintf() and then advanced rd_buf_ptr by that same fixed amount. The format-string length has no relation to the formatted output length, so snprintf() truncated each field at a NUL it wrote inside the buffer while the pointer was advanced past it. The result is a buffer peppered with embedded NUL bytes and fields that are silently cut short, so the data read back from the debugfs node does not reflect the actual link settings. [How] Use scnprintf() with the real remaining buffer size (rd_buf_size - (rd_buf_ptr - rd_buf)) and advance rd_buf_ptr by its return value, which is the number of characters actually written. This both bounds each write to the space left in rd_buf and keeps the output a single, properly terminated string. The now-unused str_len local is removed. Fixes: 41db5f1931ec ("drm/amd/display: set-read link rate and lane count through debugfs") Assisted-by: Copilot:claude-opus-4.8 Signed-off-by: Harry Wentland <harry.wentland@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysMerge ras/edac-misc into for-nextBorislav Petkov (AMD)
* ras/edac-misc: MAINTAINERS: Update Qiuxu Zhuo's email address Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
8 daysdrm/amdgpu: skip the VMID 0 flush for VRAMArunpravin Paneer Selvam
Clear-on-release only runs on VRAM, which amdgpu_ttm_map_buffer() reaches via its direct MC address without programming a GART window, yet the wipe still forces a VMID 0 flush. On GFX11 (e.g. Navi33) that spurious SDMA flush can wedge the engine; only flush when a GART window is actually used. v2: Let amdgpu_ttm_map_buffer() return whether the VMID 0 flush is needed, and drive the clear and copy paths from that. (Christian) v3: Make the vm_needs_flush output parameter mandatory instead of allowing NULL. (Christian) Fixes: a68c7eaa7a8f ("drm/amdgpu: Enable clear page functionality") Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5413 Cc: Christian König <christian.koenig@amd.com> Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysMAINTAINERS: Update Qiuxu Zhuo's email addressQiuxu Zhuo
Following a job transition, update my email address to my current work address. I'm willing to continue reviewing EDAC patches. Signed-off-by: Qiuxu Zhuo <qzhuo@nvidia.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Acked-by: Tony Luck <tony.luck@intel.com> Link: https://patch.msgid.link/20260909151531.69074-1-qzhuo@nvidia.com
8 daysdrm/amd/display: Consult MCCS FreeSync cap only if requested & supportedMichel Dänzer
When the do_mccs parameter is false, we don't call dm_helpers_read_mccs_caps, so sink->mccs_caps.freesync_supported is unlikely to be true. Fixes: 6f71d5dd3206 ("drm/amd/display: Read sink freesync support via mccs") Bug: https://gitlab.freedesktop.org/drm/amd/-/work_items/5286 Signed-off-by: Michel Dänzer <mdaenzer@redhat.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysdrm/amd/pm: Separate PPT limit restore from smu_set_ac_dcLijo Lazar
Move the PPT limit restore out of smu_set_ac_dc. Keep smu_set_ac_dc only for switching the power source. Drop the restore ppt limit policy parameter and add the restore logic to ac/dc notification path. Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 daysMerge branch '200GbE' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-09-08 (idpf, ice) For idpf: Myeonghun Pak adds calls to disable DIM work and PTM to allow for proper cleanup. Josh adds check, and adjustment, for VLAN headers when processing RSC packets. For ice: Jake adds call to xa_destroy for xarray sched_node_ids; also moving it from port_info struct to ice_hw to simplify its lifecycle management. Jakub Kicinski stores trace event data as scalars instead of dereferencing pointers in TP_printk(), preventing use-after-free issues during event printing and eliminating double-dereference warnings. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: eth: ice: don't dereference pointers from TP_printk() ice: add missing xa_destroy for sched_node_ids idpf: account for VLAN header when parsing RSC packet header idpf: disable PTM on probe failure and on remove idpf: disable DIM work before freeing q_vectors ==================== Link: https://patch.msgid.link/20260908214502.528440-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysALSA: hda/realtek: Fix speaker dropouts on MSI GE66 Raider 11UEAndrew Udvare
The speakers on this laptop are driven by a Realtek ALC1316 smart amplifier sitting behind the ALC298 processing-coefficient tunnel. Nothing configures it, so it runs on its power-up defaults with silence detection enabled: the speaker path is muted after roughly 0.2 s of quiet and takes roughly 0.4 s to reopen. Anything arriving in that window is lost, so the beginning of every sound that follows a pause is cut off. It is most obvious with speech synthesis, where the first syllable of each utterance disappears, but it affects music equally. Headphones do not pass through the amplifier and are never affected. Measured on the affected machine with generated tones: isolated 150 ms bursts spaced one second apart are inaudible, the same bursts spaced 100 ms apart are heard, and a continuous tone loses only its first 0.4 s. Add a fixup that programs the amplifier's initialisation sequence at codec init, which turns silence detection off. Writes go through the tunnel with coefficient 0x22 selecting the amplifier, 0x23 carrying the 16-bit register, 0x24 and 0x25 the value's high and low halves, and 0x26 committing. Link: https://github.com/thesofproject/sof/issues/5842 Signed-off-by: Andrew Udvare <audvare@gmail.com> Link: https://patch.msgid.link/20260909193104.26508-1-audvare@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
8 daysregulator: Add MPS MPQ4210 buck-boost regulator supportMark Brown
Tapio Reijonen <tapio.reijonen@vaisala.com> says: This series adds support for the Monolithic Power Systems MPQ4210, a 40V synchronous four-switch buck-boost controller with an I2C interface. The output voltage is programmed through an 11-bit feedback reference DAC with a 1mV step and is then scaled by an external feedback resistor divider, so the divider ratio has to be described in the device tree. The same ratio applies to the reference slew rate, so the four rates that the Control 1 SR field selects are scaled into a per-device ramp_delay_table and the field is exposed through regulator_set_ramp_delay_regmap(). The current limit, switching frequency, dither and interrupt registers are left at their reset values. Only 0.3V to 2.047V of the DAC range is specified, so linear_min_sel holds the driver to that and the lower selectors are not offered. On a board with a gain of 14 that is the difference between a floor of 4.2V and one of 0V, and the lower part of that range does not regulate. Scaling the ramp table is a deliberate difference from ltc3589 and mp886x, which read an equivalent feedback-divider property but keep their ramp values unscaled. Every other constraint in the device tree is expressed at the regulator output, so the selectable rates have to be as well, or regulator-ramp-delay would select the wrong SR encoding. It does mean the reachable rates are board specific and no value can be copied between boards, so the binding documents how they are derived and shows the calculation in its example. Two details are worth a reviewer's attention. Enable follows the start-up sequence the datasheet spells out: commit the reference with the GO bit, wait 200ms, then set ENPWR. That is why .enable is open coded rather than using regulator_enable_regmap. Control 1 bit 2 is documented only as "Reserved", but the datasheet notes that it must be set to one before the IC starts up. Its reset value is zero, so probe sets it. One consequence of the hardware worth spelling out: the MPQ4210 does not respond on the I2C bus while EN is deasserted. The enable GPIO is therefore claimed and asserted before the first register access and held for the lifetime of the device, rather than being handed to the core as regulator_config::ena_gpiod, which would drop the bus along with the output. Tested on an i.MX6SX board, regulator behind an I2C mux, feedback divider 100k/7.685k giving a gain of 14.0124, a 14012uV step and a 4.204V floor: - A 16 point staircase from 4.204V to 25.2V: the commanded voltage, the value read back and the selector decoded from the two reference registers agree exactly at every point, and a meter on the rail follows. - With the rail up and no regulator-ramp-delay in the device tree, Control 1 reads 0x45: SR at its reset value, bit 2 set, GO self-cleared and ENPWR set. Interrupt status reads clear. - regulator-ramp-delay picks the SR encoding as intended. 1050, an exact entry of this board's scaled table, gives 0x85. 3000, above every entry, warns "Can't set ramp-delay 3000, setting 2101" and gives 0xC5. - Sampling Control 1 across a disable and re-enable shows 0x45, 0x44, 0x45, so ENPWR is cleared and restored as expected. - Enable takes 230ms, against roughly 16ms for a plain register write on this bus. Link: https://patch.msgid.link/20260910-mpq4210-regulator-v1-0-d37e208dfc8d@vaisala.com
8 daysregulator: Add MPS MPQ4210 buck-boost regulator driverTapio Reijonen
The MPQ4210 is a 40V synchronous four-switch buck-boost controller with an I2C interface. Add a driver exposing voltage control and enable control through the regulator interface. The output voltage is programmed by an 11-bit feedback reference DAC with a 1mV step, split across REF_LSB[2:0] and REF_MSB[7:0], and is then scaled by the external feedback divider described in the device tree. Only 0.3V to 2.047V of that range is specified, so linear_min_sel holds the driver to it and the lower selectors are not offered. Scaled by the divider, that floor is not zero: 4.2V on a board with a gain of 14, and the core narrows regulator-min-microvolt to it. The same divider ratio applies to the slew rate, so the four reference slew rates that the Control 1 SR field selects are scaled into a per-device ramp_delay_table and the field is exposed through regulator_set_ramp_delay_regmap(). ramp_delay is initialised from the rate SR is currently programmed for, so the core waits in proportion to the size of each change; a board that sets regulator-ramp-delay reprograms SR and the core uses that value instead. Enabling follows the start-up sequence in the datasheet: commit the reference with the GO bit, wait 200ms, then set ENPWR. Control 1 bit 2 is documented as reserved but has to be set before the controller starts up, so probe sets it. The controller does not respond on the bus while EN is deasserted, so the enable GPIO is claimed before the first register access. Link: https://www.monolithicpower.com/en/mpq4210.html Signed-off-by: Tapio Reijonen <tapio.reijonen@vaisala.com> Link: https://patch.msgid.link/20260910-mpq4210-regulator-v1-2-d37e208dfc8d@vaisala.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysregulator: dt-bindings: Add MPS MPQ4210Tapio Reijonen
The MPQ4210 is a 40V synchronous four-switch buck-boost controller with an I2C interface. Its output voltage is programmed through an 11-bit feedback reference DAC covering 0 to 2.047V in 1mV steps, and is then scaled by an external feedback resistor divider, so the divider ratio has to be described in the device tree for the driver to translate reference voltages into output voltages. The divider is given in ohms rather than the kilo ohms used by mps,mp886x.yaml because the bottom resistor is not necessarily a whole number of kilo ohms. The same divider scales the reference ramp rate, so unlike the other bindings that scale by a feedback divider there is no portable value a board can copy into regulator-ramp-delay. Describe how the selectable rates are derived from the four reference slew rates, and show the calculation in the example. Signed-off-by: Tapio Reijonen <tapio.reijonen@vaisala.com> Link: https://patch.msgid.link/20260910-mpq4210-regulator-v1-1-d37e208dfc8d@vaisala.com Signed-off-by: Mark Brown <broonie@kernel.org>
8 daysALSA: hdspm: Add a new PCI device ID (1d18:3fc6) for RME HDSPe AIO PCI ↵Takashi Iwai
express audio The RME HDSPe AIO PCI express audio card has a new PCI vendor ID (1d18) while keeping the same device ID (3fc6). The card seems working fine by just adding the new ID. While we're at it, use the standard macro to cleann up the existing PCI ID entry, too. Reported-by: AtmanActive <alsa.atmanactive.3dfqt@slmail.me> Closes: https://lore.kernel.org/178674392532.7.10140952469564861620.1550442282@slmail.me Tested-by: AtmanActive <alsa.atmanactive.3dfqt@slmail.me> Link: https://patch.msgid.link/20260910144204.973359-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
8 daysopenvswitch: fix wrong flag value in get_ipv6_ext_hdrs()Eelco Chaudron
The ESP and AH cases in get_ipv6_ext_hdrs() used IPPROTO_FRAGMENT instead of OFPIEH12_FRAG when checking for out-of-order extension headers, causing the fragment header to not be recognised as a valid predecessor. The original code used IPPROTO_FRAGMENT (44) as a bitmask constant where OFPIEH12_FRAG (1 << 4 = 16) was intended. IPPROTO_FRAGMENT encodes bits 2, 3 and 5 (OFPIEH12_AUTH | OFPIEH12_DEST | OFPIEH12_ROUTER), but not bit 4 (OFPIEH12_FRAG). This caused incorrect OFPIEH12_UNSEQ verdicts in both the ESP and AH arms: the ESP arm failed to whitelist OFPIEH12_FRAG, while the AH arm accidentally whitelisted OFPIEH12_AUTH. With the fix, a packet with two AH headers now also gets OFPIEH12_UNSEQ in addition to OFPIEH12_UNREP, matching the ESP arm which already sets UNSEQ on a repeat, which is the intended behavior. Fixes: 28a3f0601727 ("net: openvswitch: IPv6: Add IPv6 extension header support") Reported-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Reviewed-by: Ilya Maximets <i.maximets@ovn.org> Signed-off-by: Eelco Chaudron <echaudro@redhat.com> Link: https://patch.msgid.link/1b1582eb07550d71f3cbe210e5cb31eeb8d0ad86.1788876917.git.echaudro@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysipmr: account multicast table and route memoryZihan Xi
A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRT_TABLE and MRT6_TABLE. Each unseen id allocates an mr_table via the shared mr_table_alloc(), links it into the per-net list, and leaves it until netns teardown. Those objects were not charged to memcg, so the host unreclaimable slab grows with the table count. Account mr_table allocations with GFP_KERNEL_ACCOUNT and mark the IPv4/IPv6 MFC caches SLAB_ACCOUNT. This matches the established handling of IP addresses, routes and alternate interface names. Unresolved MFC entries are still allocated from softIRQ with GFP_ATOMIC and are not charged. They expire after 10 seconds and are bounded by the socket receive queue; see commit 0079ad8e8dc3 ("ipmr: remove hard code cache_resolve_queue_len limit"). Fixes: f0ad0860d01e ("ipv4: ipmr: support multiple tables") Fixes: d1db275dd3f6 ("ipv6: ip6mr: support multiple tables") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Signed-off-by: Zihan Xi <zihanx@nebusec.ai> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/050b58f7fc6b45da0fb12768ebb62d18fa46133d.1788784801.git.zihanx@nebusec.ai Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysnet: phy: dp83td510: handle the active-high LED polarity modeDonggeun Yoo
dp83td510_led_polarity_set() only recognizes PHY_LED_ACTIVE_LOW, so PHY_LED_ACTIVE_HIGH falls through to the default case and returns -EINVAL. of_phy_led() propagates the error, of_phy_leds() drops the LEDs registered so far and passes it on, and phy_probe() returns it. A device tree marking a DP83TD510 LED as 'active-high', which leds/common.yaml allows and ethernet-phy.yaml references for led@N nodes, thus leaves the mdio device unbound, so phy_attach_direct() falls back to the genphy driver, which cannot drive this 10BASE-T1L single-mode PHY, so the interface has no usable link. The callback initializes polarity to DP83TD510E_LED_POLARITY(index), which is the active-high setting, so the request is already satisfied and only the case label is missing. Cc: stable@vger.kernel.org Fixes: 5b281fe7e396 ("net: phy: dp83td510: introduce LED framework support") Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260908105959.70453-3-donggeunyoo.kernel@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysnet: macb: initialize PTP state before registering clockRunyu Xiao
gem_ptp_init() registers the PTP clock before initializing bp->tsu_clk_lock and the TSU hardware. Since ptp_clock_register() publishes the PTP character device, userspace may invoke PTP callbacks before the lock and hardware are ready. In addition, gem_ptp_init() is called from both the interface open and resume paths. Reinitializing tsu_clk_lock there can reset the lock while timestamp processing is using it. This race is theoretical and has not been observed in practice. Initialize tsu_clk_lock once during probe and initialize the TSU before registering the PTP clock. Fixes: ab91f0a9b5f4 ("net: macb: Add hardware PTP support") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/netdev/20260904030439.3994047-1-runyu.xiao@seu.edu.cn/ Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn> Link: https://patch.msgid.link/20260908103924.607033-1-runyu.xiao@seu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysnet: hsr: enable promiscuous mode on interlink port with fwd offloadMD Danish Anwar
hsr_portdev_setup() skips promiscuous mode on non-master ports when hsr->fwd_offloaded is set. fwd_offloaded is derived only from the ring slaves' NETIF_F_HW_HSR_FWD bit, so this also skips it for the interlink port, which never gets forwarding offload. Without promiscuous mode, the interlink NIC drops unicast frames addressed to hsr_dev's MAC (e.g. SAN traffic to the RedBox), breaking RedBox whenever the ring is HW-offloaded. Fixes: 5055cccfc2d1 ("net: hsr: Provide RedBox support (HSR-SAN)") Signed-off-by: MD Danish Anwar <danishanwar@ti.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de> Link: https://patch.msgid.link/20260908090856.2876114-1-danishanwar@ti.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysipv6: fix fib6 walker UAF on seq stopZihan Xi
ipv6_route_iter_active() treats a walker in FWS_U at the table root as already unlinked. fib6_del_route() can move a still-linked walker into that same state when the current leaf is the last route at the root, so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq private object can then be freed while it remains on net->ipv6.fib6_walkers. A later route deletion walks the dangling list and uses the freed walker. Use the list head as membership state and reinitialize it when unlinking. Keep the existing w->node check so a never-started iterator with a zeroed private object is not treated as linked. The same stop helper is used by /proc/net/ipv6_route and by the BPF ipv6_route iterator. The BPF show path only widens the race. Fixes: 8d2ca1d7b5c3 ("ipv6: avoid high order memory allocations for /proc/net/ipv6_route") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Co-developed-by: Luxing Yin <root@tr0jan.top> Signed-off-by: Luxing Yin <root@tr0jan.top> Signed-off-by: Zihan Xi <zihanx@nebusec.ai> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/89699735763f6c297584d7c2ff106239cc1e8ce0.1788837093.git.zihanx@nebusec.ai Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysMerge branch 'net-fix-typos-and-repeated-words-in-comments'Jakub Kicinski
Hemanth Selam says: ==================== net: fix typos and repeated words in comments Fix misspellings and repeated words in comments across the networking code, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Comments only, no code changes. ==================== Link: https://patch.msgid.link/20260908052602.27497-1-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysnet: dec: fix typos in commentsHemanth Selam
Fix misspellings in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Comments only, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260908052602.27497-11-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysnet: atheros: fix typos in commentsHemanth Selam
Fix misspellings in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Comments only, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260908052602.27497-10-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysnet: hisilicon: fix typos in commentsHemanth Selam
Fix misspellings in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Comments only, no code changes. Reviewed-by: Jijie Shao <shaojijie@huawei.com> Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260908052602.27497-9-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysnet: marvell: fix typos in commentsHemanth Selam
Fix misspellings in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Comments only, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260908052602.27497-8-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysnet: fddi: fix typos in commentsHemanth Selam
Fix misspellings in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Comments only, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260908052602.27497-7-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysnet: qlogic: fix typos in commentsHemanth Selam
Fix misspellings in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Comments only, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260908052602.27497-6-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysnet: cavium: fix typos in commentsHemanth Selam
Fix misspellings in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Comments only, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260908052602.27497-5-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysnet: broadcom: fix typos in commentsHemanth Selam
Fix misspellings in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Comments only, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260908052602.27497-4-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysselftests: net: fix repeated word 'use' in commentHemanth Selam
Drop the second 'use', reported by checkpatch.pl as a possible repeated word. Only touches a comment, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260908052602.27497-3-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysnet: llc: fix repeated word 'all' in commentHemanth Selam
Drop the second 'all', reported by checkpatch.pl as a possible repeated word. Only touches a comment, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260908052602.27497-2-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysnet: stmmac: fix TX descriptor availability check for TSO trafficLorenzo Bianconi
stmmac_tso_xmit() estimates the number of free TX descriptors required by a TSO skb as: (skb->len - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1 which assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This underestimates the descriptors actually consumed by stmmac_tso_allocator(), since each fragment is mapped individually and so it needs at least one descriptor regardless of its size. Moreover, one descriptor is used for the L2/L3/L4 headers and, when the MSS changes, one more is consumed for the MSS context descriptor. For a highly fragmented TSO skb the check can therefore pass even when the ring has too few free slots. stmmac_tso_allocator() then writes past the available descriptors, overwriting descriptors still owned by the DMA engine, corrupting the TX ring. Add stmmac_tso_get_num_desc() to compute the exact number of descriptors needed for the header, the linear payload and each fragment, plus the MSS context descriptor when required, and use it in the availability check. Fixes: f748be531d70 ("stmmac: support new GMAC4") Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com> Link: https://patch.msgid.link/20260907-stmmac-fix-tso-nfrags-check-v1-1-328459906cdb@oss.qualcomm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysnet/rds: fix tcp stream corruption with large pagesGreg Marsden
rds_message_map_pages() assigns PAGE_SIZE bytes to every scatterlist entry, even when total_len ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems with PAGE_SIZE greater than 8192 the scatterlist maps bytes beyond the end of the congestion map. RDS-TCP transmits the SG contents according to those lengths, so the extra bytes become part of the TCP RDS stream and are interpreted as subsequent RDS message headers, corrupting the stream. Limit the final scatterlist mapping to the number of bytes remaining. This has no effect on systems with a 4K page size and allows RDS-TCP to be used on systems with 16K and larger page sizes. The RDS selftest, which previously hung on 16K pages, now passes. Fixes: 7875e18e0996 ("RDS: Message parsing") Signed-off-by: Greg Marsden <greg.marsden@oracle.com> Reviewed-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/apxJjxvStibPI0AS@oracle.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
8 daysdrm/xe/shrinker: Take a runtime PM ref before shrinking non-system memoryShuicheng Lin
__xe_shrinker_walk() walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which needs the device resumed, so while it is runtime suspended the page table zap trips an assert and the TLB invalidation returns -ENODEV: WARNING: drivers/gpu/drm/xe/xe_bo.c:770 at xe_bo_move_notify+0x1fc/0x450 [xe] xe_bo_shrink+0x20f/0x2b0 [xe] __xe_shrinker_walk+0x174/0x410 [xe] xe_shrinker_scan+0x10c/0x1e0 [xe] do_shrink_slab+0x176/0x7e0 drop_caches_sysctl_handler+0x9c/0xf0 Take a reference before walking a memory type other than XE_PL_SYSTEM and stop there if it cannot be acquired. Reuse the shrinker's existing acquire path, which resumes the device directly where reclaim allows that and otherwise queues the PM worker for a later scan. Stop the walk once the scan target is met, so a satisfied scan does not wake the device. System memory is still reclaimed while the device is suspended. Gate this on xe_device_is_l2_flush_optimized(), the same condition under which xe_bo_trigger_rebind() issues the invalidation for a non-fault-mode vm, so reclaim is unaffected elsewhere. The System CCS copy already has its own reference in xe_bo_shrink(). Only a non-fault-mode vm can reach this, since a fault-mode vm requires LR mode and that holds a runtime PM reference for the vm's lifetime. Reproduced with igt@xe_madvise@dontneed-before-exec while the GPU is runtime suspended. v2: simplify needs_rpm check. (Matt) retarget Fixes tag since the issue occurs with the non-fault-mode path added by 4e7ebff69aed. v3: handle this in xe_shrinker.c instead of xe_bo.c (Thomas) v4: stop the walk once the scan target is met. (Sashiko) v5: rebase on the freed page accounting fix. (Sashiko) v6: reuse the shrinker acquire path so runtime pm can be resumed directly instead of always queueing a worker. (Thomas) v7: replace xe_pm_runtime_put() with xe_shrinker_runtime_pm_put(). (Thomas) Fixes: 4e7ebff69aed ("drm/xe/xe3p_lpg: flush shrinker bo cachelines manually") Assisted-by: Claude:claude-opus-5 Cc: Tejas Upadhyay <tejas.upadhyay@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/20260909162102.1097006-3-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>