summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-07-15media: ivtv: stop VBI start-code scan before short tailPengpeng Hou
compress_sliced_buf() scans one byte at a time while testing a four-byte VBI start code. The final iterations can read beyond the remaining buffer tail. Stop the scan once fewer than four bytes remain. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15media: cx18: stop VBI start-code scan before short tailPengpeng Hou
compress_sliced_buf() scans one byte at a time while testing a four-byte VBI start code. The final iterations can read beyond the remaining buffer tail. Stop the scan once fewer than four bytes remain. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15media: pci: Use PCI_DEVICE macros and drop zeros from pci_device_id arraysUwe Kleine-König (The Capable Hub)
Some pci_device_id arrays already used the PCI_DEVICE macros, others used named initializers or list initializers. Unify all to use the PCI_DEVICE macros and (if applicable) a named initializer for .driver_data. Also drop all zeros that the compiler can care for and unify indention and spacing. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15staging: media: tegra-video: vi: Improve media graph building logicSvyatoslav Ryhel
The existing tegra_vi_graph_build function relies heavily on a one-to-one match between Device Tree nodes and media pad links. While this works for simpler configurations, it causes issues when Device Tree nodes do not match media pad link logic (e.g., mt9m114). Switch to the media_entity_get_fwnode_pad helper to verify and retrieve the correct pad linked to an endpoint, rather than assuming the endpoint ID matches the pad ID. Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15media: ti: vpe: #include <linux/platform_device.h> explicitlyUwe Kleine-König (The Capable Hub)
The driver uses several symbols and structs defined in that header. The header is currently included transitively via "vip.h" -> <media/v4l2-ctrls.h> -> <media/media-request.h> -> <media/media-device.h> -> <linux/platform_device.h> which seems to be on the lower end of the scale between random and reliable. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15staging: media: av7110: refactor av7110_start_feed to reduce indentationAndré Moreira
The av7110_start_feed function contains heavily nested if-statements, causing excessive indentation and violating code style guidelines. Refactor the logic inside the DMX_MEMORY_FE case by inverting the conditional check to break early. Additionally, remove the inner 'if (feed->ts_type & TS_DECODER)' check, as it is redundant since the outer block already validates this condition. This reduces the indentation level and cleans up redundant checks without altering the underlying driver behavior. Signed-off-by: André Moreira <andrem.33333@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15accel/ivpu: Reject firmware log with size smaller than headerJhonraushan
fw_log_from_bo() validates the tracing buffer header_size and that the log fits within the BO, but never checks that log->size is at least log->header_size. fw_log_print_buffer() then computes: u32 data_size = log->size - log->header_size; which underflows to a near-U32_MAX value when firmware reports a log whose size is smaller than its header. That huge data_size defeats the log_start/log_end bounds clamps added by commit dd1311bcf0e6 ("accel/ivpu: Add bounds checks for firmware log indices"), so fw_log_print_lines() reads far past the small real data region of the BO. A size of 0 also makes fw_log_from_bo() advance the offset by 0, causing the callers to loop forever on the same header. Reject logs whose size is smaller than the header (which also rejects size == 0). Fixes: d4e4257afa6e ("accel/ivpu: Add firmware tracing support") Cc: stable@vger.kernel.org Signed-off-by: Jhonraushan <raushan.jhon@gmail.com> Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com> Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com> Link: https://patch.msgid.link/20260715074206.867712-1-raushan.jhon@gmail.com
2026-07-15media: imx355: Remove storing cur_mode in the stateDave Stevenson
All the information for the mode is now stored within the subdev state, so configure the sensor based on that. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Switch to using the subdev stateDave Stevenson
The subdev state is now preferred rather than handling crop and format within the driver state, so switch the driver to using it. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Support 2 lane readoutDave Stevenson
The sensor supports 2 or 4 lane readout, but the driver only allowed for 4 lanes. Add 2 lane support. The clock tree only supports single PLL mode to feed both IOP (MIPI) and IVT (Pixel array). 2 lane mode supports a MIPI link frequency of up to 445MHz (890Mbit/s) cf 360MHz (720Mbit/s) for 4lane. Update clock setup and pixel rates to match. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Compute link frequency from PLL setupDave Stevenson
In preparation for additional options in the PLL setup, compute the link frequency rather than using a hardcoded value. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Use NULL ctrl_ops for HBLANK as it is a read-only controlDave Stevenson
This avoids the set_ctrl handler being called under any circumstances, as it will return an error for the unhandled ctrl. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Define the exposure offset, and use that defineDave Stevenson
The difference between frame length and max exposure time in lines is 10. That had been used as a bare value in calculations. Move it to a define, and use that define. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Set the colorspace in the formatDave Stevenson
The colorspace fields were left set to 0 when they should be set appropriately for a raw image sensor. Add those values. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Convert to new CCI register access helpersDave Stevenson
Use the new comon CCI register access helpers to replace the private register access helpers in the imx355 driver. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Use pm_runtime autosuspend_delayDave Stevenson
Avoid powering the sensor up and down unnecessarily by using pm_runtime's autosuspend_delay feature. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Add support for get_selectionDave Stevenson
Provide all the cropping information via get_selection. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Remove redundant fll_min, and implement fixed offsetDave Stevenson
fll_min (Frame Length Lines) is set to the same value as fll_def for all modes, which makes it redundant. The actual value is also erroneous as the sensor works in all the defined modes with FLL set at the mode height + 20 lines, so set the vblank control minimum to 20 rather than varying it. This also improves the maximum frame rate achievable. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: pixel_rate never changes, so don't recomputeDave Stevenson
The pixel rate is always the same, so there is no need to try and recompute it in imx355_set_pad_format, and then no need to have the pointer to it stored. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Remove link_freq_index from each mode as ununsedDave Stevenson
The link_freq_index value in imx355_mode is unused, so remove it. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Set binning mode registers programmaticallyDave Stevenson
Compute the binning registers based on the difference between the mode width/height vs the crop width/height. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Set register LINE_LENGTH_PCK programmaticallyDave Stevenson
The driver already has the LLP value stored in the mode structure, but also had the same value set via register writes in the mode's register list. Remove this duplication. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Programmatically set the crop parameters for each modeDave Stevenson
Currently the cropping is set via register entries in the per mode register lists. Add the crop information to the mode structure as a v4l2_rect, and set the registers programmatically. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Remove setting FRM_LENGTH_LINES in the mode regsDave Stevenson
Registers 0x0340 and 0x0341 (FRM_LENGTH_LINES) are already written from the set_ctrl(V4L2_CID_VBLANK) handler, so don't write them from the mode register list. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Remove duplicated registers from the mode tablesDave Stevenson
A large number of registers are identical within all the modes. Move those to imx355_global_regs. Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Add support for 24 MHz external clockDavid Heidelberg
The IMX355 sensor supports multiple external clock frequencies, including 19.2 MHz and 24 MHz. The driver currently supports only fixed 19.2 MHz input clock. Refactor the clock handling to make the PLL configuration dependent on the external clock frequency and add support for 24 MHz. Introduce a table of clock parameter sets and program the corresponding EXTCLK frequency and PLL multipliers to maintain consistent internal VCO frequencies across supported inputs. The PLL settings are adjusted so that OP VCO remains at 720 MHz This preserves existing timing characteristics while allowing systems using a 24 MHz clock to operate correctly. No functional change for existing 19.2 MHz users. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: David Heidelberg <david@ixit.cz> Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: imx355: Avoid calling imx355_power_off twice in error pathDave Stevenson
If v4l2_async_register_subdev_sensor failed, then the sensor had already been powered down by pm_runtime_idle, but the error path then also explicitly called imx355_power_off as well. That left an imbalance in the regulator and clock calls. Call pm_runtime_idle only after v4l2_async_register_subdev_sensor succeeds to avoid this. Fixes: efa5fe19c0a9 ("media: imx355: Enable runtime PM before registering async sub-device") Cc: stable@vger.kernel.org Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15irqchip/gic-v3: Add Renesas R-Car Gen4 erratum workaroundMarek Vasut
Renesas R-Car S4/V4H/V4M GIC600 integration has address width for AXI or APB interface configured to 32 bit, it can therefore access only the first 4 GiB of physical address space. This information comes from R-Car V4H Interface Specification sheet; there is currently no technical update number assigned to this limitation. Further input from hardware engineer indicates that this limitation also applies to R-Car S4 and V4M. Name the limitation GEN4GICITS1, and add a driver quirk to mitigate this limitation. The quirk is keyed on the combination of the GIC implementation and the platform identification in the device tree. Co-developed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Acked-by: Marc Zyngier <maz@kernel.org> Acked-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260707203743.88299-5-marek.vasut+renesas@mailbox.org
2026-07-15irqchip/gic-v3: Refactor GIC600 limited to 32bit PA erratum handlingMarek Vasut
The GIC600 implementation is now known to be used on multiple 64-bit SoCs, where it has address width for AXI or APB interface configured to 32 bit, and it can access only the first 4GiB of physical address space. Rework the handling of the quirk to work around this limitation such that new entries can be added purely as new compatible strings, with no need to add additional functions or new its_quirk array entries. Suggested-by: Marc Zyngier <maz@kernel.org> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Acked-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260707203743.88299-4-marek.vasut+renesas@mailbox.org
2026-07-15PCI: rcar-gen4: Configure AXIINTC if iMSI-RX is not usedMarek Vasut
When MSI is enabled but the DWC built-in iMSI-RX is not used, MSI must be handled via the GIC ITS. Configure all controller MSI registers accordingly. Set or clear the MSICAP0 MSIE bit and the PCIEINTSTS0EN MSI_CTRL_INT bit based on the MSI enable state. Set both bits when MSI is enabled. Clear both bits when MSI is disabled. When MSI is disabled, or when MSI is enabled together with iMSI-RX, clear AXIINTCADDR and AXIINTCCONT to disable any pass through of MSI TLPs onto the AXI bus and further into the GIC ITS translation registers. When MSI is enabled and iMSI-RX is not used, program AXIINTCADDR with the target address of the GIC ITS translation register, and program AXIINTCCONT to enable MSI TLP pass through onto the AXI bus and into the GIC ITS. This configuration allows the GIC ITS to handle MSI instead of the integrated iMSI-RX. The driver includes linux/irqchip/arm-gic-v3.h which pulls in headers which are available only on ARM and ARM64, on other architectures the headers are not present and the driver fails to build. This driver is used only on ARM64 hardware, so isolate its build only to ARM64 to avoid build failures on other architectures. Co-developed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> [mani: commit log and squashed the Kconfig fix: https://patch.msgid.link/20260714131957.38067-1-marek.vasut+renesas@mailbox.org] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260707203743.88299-3-marek.vasut+renesas@mailbox.org
2026-07-15dm: use `clear_and_wake_up_bit()` in device mapperJiangong.Han
The helper was introduced in 'commit 8236b0ae31c83 ("bdi: wake up concurrent wb_shutdown() callers.")' as a generic way of doing the same sequence of operations: clear_bit_unlock(); smp_mb__after_atomic(); wake_up_bit(); The helper was first implemented to avoid bugs caused by forgetting to call `wake_up_bit()` after `clear_bit_unlock()`. Replace the open-coded sequence with the helper to avoid duplicate code and reduce code paths to maintain. Suggested-by: code@agatha.dev Link: https://kernelnewbies.org/Beginner%20Cleanup%20and%20Refactor%20Tasks%20by%20Agatha%20Isabelle%20Moreira#task_001 Link: https://kernelnewbies.org/Beginner%20Cleanup%20and%20Refactor%20Tasks%20by%20Agatha%20Isabelle%20Moreira#task_002 Signed-off-by: Jiangong.Han <jiangong.han@windriver.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-07-15dm: drop redundant nonseekable_open() return checkbui duc phuc
nonseekable_open() never fails, so the error check is unnecessary. Remove the dead error handling path. Signed-off-by: Bui Duc Phuc <phucduc.bui@gmail.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-07-15dm-switch: use WRITE_ONCE() in switch_region_table_write()Haotian Zhang
switch_region_table_read() accesses the region table with READ_ONCE() and is called from the lockless switch_map() IO path. However, switch_region_table_write() stores to the same array with a plain assignment. This results in an inconsistent access pattern for a lockless shared variable and may trigger data race reports. Use WRITE_ONCE() to pair with the existing READ_ONCE() in switch_region_table_read(). Cc: stable@vger.kernel.org Fixes: 99eb1908e643 ("dm switch: factor out switch_region_table_read") Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-07-15PCI: mediatek: Add support for EcoNet EN7528 SoCCaleb James DeLisle
Add support for the PCIe controller present in the EcoNet EN7528 (and EN751221) SoCs. The PCIe controllers present in these SoCs support 2.5 GT/s and 5 GT/s data rates, but 5 GT/s require re-training after link up. Co-developed-by: Ahmed Naseef <naseefkm@gmail.com> Signed-off-by: Ahmed Naseef <naseefkm@gmail.com> Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr> [mani: commit log] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260702150704.265282-1-cjd@cjdns.fr
2026-07-15dm cache: parse invalidate_cblocks with kstrtouint()Samuel Moelius
invalidate_cblocks parses cache block numbers with sscanf() and then stores them in the narrower dm_cblock_t type. Values larger than the cblock representation are truncated before invalidation, so a request for one cache block can invalidate a different block. Checking the parsed value after sscanf() is not sufficient because sscanf() does not reliably reject values beyond U64_MAX before storing into the destination. Such inputs can still be converted to a wrapped u64 value and then pass a later range check. Split ranges in place and parse each single value or range endpoint directly with kstrtouint() instead. This rejects malformed values and values that do not fit in dm_cblock_t before they can be converted to cblock values. The existing range validation continues to reject empty or out-of-cache ranges, including the single-value U32_MAX case whose exclusive end wraps to zero. Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>
2026-07-15drm/amdgpu: add mes gang contex alloc/free helperPrike Liang
Implement the MES gang contex alloc and free heplers. Signed-off-by: Prike Liang <Prike.Liang@amd.com> Reviewed-by: Michael Chen <michael.chen@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-15drm/amd: Create a device link between APU display and XHCI devicesMario Limonciello
Some AMD APU multi-function devices expose an integrated USB xHCI controller. In some circumstances (such as larger VRAM), the PM core can resume can fail when the xHCI controller is resuming in parallel with the GPU/display function. On affected systems, the xHCI controller can complete pci_pm_resume and start resuming USB devices while the GPU is still in its much longer resume path. This race condition leads to USB device resume failures followed by: xhci_hcd ...: xHCI host not responding to stop endpoint command xhci_hcd ...: HC died; cleaning up Create a device link from any xHCI controller sharing the same PCIe root port as the APU display function. The link uses DL_FLAG_STATELESS and DL_FLAG_PM_RUNTIME to ensure the GPU completes its resume before the xHCI controller begins resuming USB devices. This device link is done specifically in amdgpu so that if the platform firmware has been modified such that this issue doesn't happen the version can be detected and the workaround skipped. Suggested-by: Aaron Ma <aaron.ma@canonical.com> Reported-by: mrh@frame.work Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221073 Acked-by: Alex Deucher <alexander.deucher@amd.com> Tested-by: Mark Pearson <mpearson-lenovo@squebb.ca> Tested-by: Alexander F <superveridical@gmail.com> Tested-by: Francis DB <francisdb@gmail.com> Link: https://patch.msgid.link/20260713195313.1739762-1-mario.limonciello@amd.com Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-15drm/amd/display: wire DCN42B mcache programming callbackPengpeng Hou
DCN42B enables DML2 and DML21 by default and defines dcn42b_prepare_mcache_programming(), but the resource function table only wires the callback when CONFIG_DRM_AMD_DC_DML21 is defined. There is no in-tree Kconfig symbol named DRM_AMD_DC_DML21, so the preprocessor always removes the callback entry. Sibling DCN42 and DCN401 resource tables wire their prepare_mcache_programming callbacks unconditionally, and the core DC code already checks whether the callback pointer is present before calling it. Remove the stale guard so DCN42B exposes the callback relation that its source and DML21 build world already provide. This is an RFC patch draft from static conditional callback legality auditing. It needs AMD display maintainer review before submission as a final fix. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-15drm/amd/display: set new_stream to NULL after releaseWenTao Liang
In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the pointer to NULL. If a later error (e.g., color management failure) triggers the fail label, the error path calls dc_stream_release() again on the same dangling pointer, causing a double release and potential use-after-free. Fix this by setting new_stream to NULL after the initial release. Fixes: 9b690ef3c704 ("drm/amd/display: Avoid full modeset when not required") Signed-off-by: WenTao Liang <vulab@iscas.ac.cn> Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-15drm/amd/display: remove duplicate link_dp_panel_replay.h includeAnas Khan
link_dp_irq_handler.c includes "link_dp_panel_replay.h" twice. Drop the redundant second include; this is a non-functional cleanup flagged by scripts/checkincludes.pl. Fixes: 1e5cd4adfc54 ("drm/amd/display: move panel replay out from edp") Signed-off-by: Anas Khan <anxkhn28@gmail.com> Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-15drm/amd/display: fix wrong register field in dccg35_set_hdmistreamclk_src_newDyllan Kobal
dccg35_set_hdmistreamclk_src_new() updates HDMISTREAMCLK_CNTL but passes DPSTREAMCLK0_SRC_SEL as the field identifier in the second REG_UPDATE_2 slot. The current behavior is harmless on DCN3.5 because both fields share the same bit layout, but it is still incorrect and could break on future hardware revisions. Fixes: d36771a03412 ("drm/amd/display: Add DCCG DIO, HPO, OPP, and OPTC support for FRL") Signed-off-by: Dyllan Kobal <dyllan.kobal@zetier.com> Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-15drm/amd/display: Remove unused-but-set variable hubp fromGleb Markov
The final check of hubp for NULL covers all remaining lines of code, since the value of hubp does not change until the end of the method. This check is redundant because hubp1 is already dereferenced within the macro. If it were NULL, the program would have already failed to proceed. Remove the left part of the expression with the logical "&&". Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: be1fb44389ca ("drm/amd/display: Check null pointers before used"). Signed-off-by: Gleb Markov <markov.gi@npc-ksb.ru> Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-15drm/amd/display: Remove redundant NULL check before kfree() in ↵Ziran Zhang
mod_power_create() kfree() safely handles NULL pointers, so there is no need to check for NULL before calling kfree(). Remove redundant NULL check. Found by Coccinelle ifnullfree script. Signed-off-by: Ziran Zhang <zhangcoder@yeah.net> Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-15drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05Alessandro Rinaldi
The Lenovo Legion 5 15ARH05 (Renoir) ships a BOE 0x08DF eDP panel that advertises AUX/DPCD backlight control, so amdgpu's automatic detection (amdgpu_backlight == -1) selects AUX. On this panel the AUX backlight path has no effect: brightness writes are accepted but the panel level never changes, the display is stuck at a fixed brightness and max_brightness is reported as a bogus 511000. As a result neither the desktop brightness slider nor the brightness hotkeys do anything. Forcing PWM backlight (amdgpu.backlight=0) restores working control: max_brightness becomes 65535 and the level tracks writes. This has long been applied by users as a manual kernel-parameter workaround. Extend the generic panel backlight quirk with a force_pwm flag, add an entry for the Legion 5 15ARH05 / BOE 0x08DF panel, and have amdgpu disable AUX backlight (use PWM) when the quirk matches and the user lets the driver auto-select the backlight type. Signed-off-by: Alessandro Rinaldi <ale@alerinaldi.it> Tested-by: Alessandro Rinaldi <ale@alerinaldi.it> Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-15drm/amd: Move dynamic PCIe switching quirks to X86_MATCH_* macrosMario Limonciello
Use the X86_MATCH_VENDOR_FAM() and X86_MATCH_VENDOR_FAM_MODEL() macros to make the quirks for dynamic speed switching more scalable. Acked-by: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260713172431.1599801-1-mario.limonciello@amd.com Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-15drm/amdkfd: free MQD managers on DQM init failuresGuangshuo Li
The change referenced by the Fixes tag releases the HIQ SDMA MQD trunk buffer when device_queue_manager_init() fails after it has been allocated. However, the same failure path can also be reached after init_mqd_managers() has succeeded. At that point dqm->mqd_mgrs[] contains per-type MQD manager objects owned by the device queue manager. The normal teardown path frees those objects from uninitialize(), but the initialization error path only frees dqm itself. Free the MQD managers from the initialization error path as well. This is safe for earlier failures because dqm is zeroed when allocated and init_mqd_managers() clears the entries it rolls back internally. Fixes: b7cccc8286bb ("drm/amdkfd: fix a memory leak in device_queue_manager_init()") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Reviewed-by: Mukul Joshi <mukul.joshi@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-15drm/amdgpu/ttm: Consider concurrent VM flushes for buffer entitiesTimur Kristóf
Allow using multiple SDMA schedulers only on GPUs where we are allowed to do concurrent VM flushes. This consideration is necessary because all GART windows are mapped in VMID 0 (the kernel VMID) so each buffer entity would flush VMID 0 concurrently. Practically this means that we can't use multiple SDMA engines for TTM on GFX6-8 and Navi 1x. Fixes: 01c836788b37 ("drm/amdgpu: pass all the sdma scheds to amdgpu_mman") Fixes: e4029f7a9474 ("drm/amdgpu: only use working sdma schedulers for ttm") Cc: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com> Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-15drm/amd/display: Always notify the HDA driver on connector disconnectNícolas F. R. A. Prado
amdgpu_dm_audio_eld_notify() is currently only called in atomic commits. This results in the state of the HDA driver never getting updated when an audio sink is removed and an atomic commit never comes. (eg the HDMI audio jack switch in ALSA stays 'on' after the HDMI cable is disconnected if no other display is connected to cause the compositor to submit an atomic commit) Call amdgpu_dm_audio_eld_notify() in amdgpu_dm_update_connector_after_detect() when a sink is no longer available to ensure that the HDA driver always gets notified on disconnect regardless of atomic commits. Assisted-by: Copilot:claude-sonnet-4.6 Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com> Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-15drm/amdgpu: debugfs: avoid extra EOLs in amdgpu_gem_infoMichał Mirosław
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl> Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-15drm/amd/amdgpu/cgs: Avoid redundant copying of firmware filenameMichał Mirosław
While at it, remove redundant error message - request_firmware() will log a failure anyway. Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl> Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>