summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-03drm/amd/display: Extract dm_ism_dispatch_next_eventAlex Hung
[Why & How] Separate the "should we emit IMMEDIATE?" decision into a pure, side-effect-free helper so it can be tested in isolation without a full DRM context. - dm_ism_dispatch_next_event(current_state, delay_ns, sso_delay_ns) returns DM_ISM_EVENT_IMMEDIATE when the state requires an immediate follow-up (HYSTERESIS_WAITING with zero delay, OPTIMIZED_IDLE with zero SSO delay, or TIMER_ABORTED), and DM_ISM_NUM_EVENTS otherwise. - Removes the passthrough event parameter that was always DM_ISM_NUM_EVENTS at the call site, making the sentinel explicit. - Drops the now-unused event parameter from dm_ism_dispatch_power_state. Assisted-by: Copilot:Claude-Sonnet-4.6 Reviewed-by: Ray Wu <ray.wu@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Add more KUnit tests for amdgpu_dm_ismAlex Hung
[Why & How] Add 8 more KUnit tests: - dm_ism_get_idle_allow_delay: add a case where filter_entry_count exceeds filter_history_size, exercising the max() branch in the history_size calculation. - amdgpu_dm_ism_init: verify all fields are initialised to expected values after construction. - amdgpu_dm_ism_fini: smoke-test cancellation of never-scheduled delayed work items paired with a preceding init. - dm_ism_set_last_idle_ts: verify last_idle_timestamp_ns is updated to at least the value captured before the call. - dm_ism_insert_record: verify index increment and duration calculation; verify out-of-bounds index wraps to slot 0. - dm_ism_trigger_event: verify current_state and previous_state are updated on a valid transition and left unchanged on an invalid one. Assisted-by: Copilot:Claude-Sonnet-4.6 Reviewed-by: Ray Wu <ray.wu@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Add KUnit tests for amdgpu_dm_coloropAlex Hung
[Why & How] Add a KUnit pipeline test for amdgpu_dm_build_default_pipeline(). The pipeline test uses a mock drm_device (via DRM KUnit helpers), calls amdgpu_dm_build_default_pipeline() with hw_3d_lut=true, then walks the returned colorop chain asserting the correct type sequence (degam_tf, mult, ctm, shaper_tf, shaper_lut, 3dlut, blnd_tf, blnd_lut), that every op carries bypass_property, and that the chain length is exactly eight. A kunit cleanup action calls drm_colorop_pipeline_destroy() before the device is torn down. Assisted-by: Copilot:Claude-Sonnet-4.6 Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Fix gamma 2.2 colorop TF direction in testsAlex Hung
[Why & How] Correct the gamma 2.2 TF direction used in the supported-TF bitmask tests. Degam and blnd use DRM_COLOROP_1D_CURVE_GAMMA22 (EOTF direction); shaper uses DRM_COLOROP_1D_CURVE_GAMMA22_INV (inverse EOTF direction). This aligns the tests with commit d8f9f42effd7 ("drm/amd/display: Fix gamma 2.2 colorop TFs"). Assisted-by: Copilot:Claude-Sonnet-4.6 Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Refactor amdgpu_dm_initialize_default_pipelineAlex Hung
[Why & How] Extract amdgpu_dm_initialize_default_pipeline() into a new STATIC_IFN_KUNIT helper amdgpu_dm_build_default_pipeline(). This separation makes the pipeline-building logic testable via KUnit without pulling in amdgpu_device and its dependencies that are unavailable in the UML KUnit build environment. Assisted-by: Copilot:Claude-Sonnet-4.6 Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Add more color KUnit testsAlex Hung
[Why & How] Add KUnit tests for __set_tf_bypass(), __set_tf_distributed_points(), the bypass paths of amdgpu_dm_set_atomic_regamma(), amdgpu_dm_atomic_shaper_lut(), and amdgpu_dm_atomic_blend_lut(), and all three input branches of __set_colorop_in_tf_1d_curve(). Export the three shaper/blend/regamma helpers and __set_colorop_in_tf_1d_curve with STATIC_IFN_KUNIT and EXPORT_IF_KUNIT to make their branches reachable from tests. Add the following test cases in amdgpu_dm_color_test.c: - dm_test_set_tf_bypass: verify bypass TF setup - dm_test_set_tf_distributed_points_srgb: validate sRGB gamma - dm_test_set_tf_distributed_points_pq: validate PQ gamma - dm_test_set_atomic_regamma_bypass: verify regamma bypass path - dm_test_atomic_shaper_lut_bypass: verify shaper LUT bypass path - dm_test_atomic_blend_lut_bypass: verify blend LUT bypass path - dm_test_set_colorop_in_tf_1d_curve_invalid_type: verify invalid colorop type returns -EINVAL - dm_test_set_colorop_in_tf_1d_curve_unsupported_curve: verify unsupported curve type returns -EINVAL - dm_test_set_colorop_in_tf_1d_curve_bypass: verify bypass path sets TF_TYPE_BYPASS and TRANSFER_FUNCTION_LINEAR Assisted-by: Copilot:Claude-Sonnet-4.6 Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Extract transfer function helpersAlex Hung
[Why] Extract repeated inline dc_transfer_func setup patterns into two small helper functions in amdgpu_dm_color.c. Three functions (amdgpu_dm_set_atomic_regamma, amdgpu_dm_atomic_shaper_lut, amdgpu_dm_atomic_blend_lut) each contained identical two-line bypass setup and identical three-line distributed-points setup. __set_colorop_in_tf_1d_curve contained the same two-line bypass pattern as well. [How] Extract to __set_tf_bypass() and __set_tf_distributed_points(). Replace all four bypass sites with __set_tf_bypass(), and all three distributed-points sites with __set_tf_distributed_points(). Assisted-by: Copilot:Claude-Sonnet-4.6 Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Add KUnit tests for color LUT functionsAlex Hung
[Why] Add KUnit tests for three color management functions in amdgpu_dm_color.c: amdgpu_dm_verify_lut_sizes, amdgpu_dm_atomic_lut3d, and __set_colorop_3dlut. [How] Export amdgpu_dm_verify_lut_sizes with EXPORT_IF_KUNIT. Change amdgpu_dm_atomic_lut3d and __set_colorop_3dlut from static to STATIC_IFN_KUNIT and export them with EXPORT_IF_KUNIT. Add their prototypes to amdgpu_dm_color.h inside the KUnit guard block. Implement 14 test cases in amdgpu_dm_color_test.c: - 8 tests for amdgpu_dm_verify_lut_sizes covering null LUTs, valid and invalid degamma/gamma sizes, both valid, and priority - 3 tests for amdgpu_dm_atomic_lut3d covering zero size clearing initialized state, nonzero setting state bits and mode flags, and LUT data forwarding to tetrahedral_17 - 3 tests for __set_colorop_3dlut covering zero size returning -EINVAL and clearing initialized state, nonzero returning 0 and setting state bits, and 32-bit LUT data forwarding to tetrahedral_17 Assisted-by: Copilot:Claude-Sonnet-4.6 Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Fix DP_PIXEL_FORMAT fields & update clk_src for DCN4xOvidiu Bunea
[Why & How] The enc1_stream_encoder_dp_get_pixel_format() function reads fields of the DP_PIXEL_FORMAT register that are deprecated on DCN4x. This breaks seamless boot because driver cannot properly determine the pixel format programmed by VBIOS. The previous changed submitted for this issue incorrectly calculated the DP DTO frequency because register access to DCN4x DP DTO registers was not working. Create a new function that reads the correct fields. Update clk_src structs to support register access for new DCN4x registers & fields. Reviewed-by: Charlene Liu <charlene.liu@amd.com> Signed-off-by: Ovidiu Bunea <ovidiu.bunea@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Bound VBIOS record-chain walk loopsHarry Wentland
[Why & How] All record-chain walk loops in bios_parser.c and bios_parser2.c use for(;;) and only terminate on a 0xFF record_type sentinel or zero record_size. A malformed VBIOS image missing the terminator record causes unbounded iteration at probe time, potentially hundreds of thousands of iterations with record_size=1. In the final iterations near the BIOS image boundary, struct casts beyond the 2-byte header validated by GET_IMAGE can also read out of bounds. Cap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256) iterations. The atombios.h defines up to 22 distinct record types and atomfirmware.h has 13. Assuming an average of less than 10 records per type (which is reasonable since most are connector- based) 256 is a generous upper bound. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Assisted-by: Copilot:claude-opus-4.6 Mythos Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer sizeHarry Wentland
[Why & How] During HDCP 2.x repeater authentication over HDMI, the driver reads the sink's RxStatus register and extracts a 10-bit message size field (max value 1023). This value is used as the read length for the ReceiverID list without being clamped to the size of the destination buffer rx_id_list[177]. A malicious HDMI repeater could advertise a message size larger than the buffer, causing an out-of-bounds write during the I2C read. Clamp the read length in mod_hdcp_read_rx_id_list() to the size of the rx_id_list buffer, matching the approach already used in the DP branch. Fixes: eff682f83c9c ("drm/amd/display: Add DDC handles for HDCP2.2") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()Harry Wentland
[Why & How] gpio_bitshift is a uint8_t read directly from the VBIOS GPIO pin table. If the value is >= 32, the expression "1 << gpio_bitshift" triggers undefined behaviour in C (shift count exceeds type width). On x86 the shift is silently masked to 5 bits, producing an incorrect GPIO mask that may cause wrong MMIO register bits to be toggled. Validate gpio_bitshift before use and return BP_RESULT_BADBIOSTABLE for out-of-range values. Fixes: ae79c310b1a6 ("drm/amd/display: Add DCE12 bios parser support") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Use krealloc_array() in dal_vector_reserve()Harry Wentland
[Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, which can silently wrap to a small value on overflow. This would cause krealloc to return a smaller buffer than expected, leading to heap overflows on subsequent vector appends. Replace krealloc() with krealloc_array() which performs an internal overflow check and returns NULL on wrap, preventing the issue. Fixes: 2004f45ef83f ("drm/amd/display: Use kernel alloc/free") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfsHarry Wentland
[Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) Fixes: c7ba3653e977 ("drm/amd/display: Generic SDP message access in amdgpu") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Avoid DPMS-on for phantom streamIlya Bakoulin
[Why & How] Calling dc_update_planes_and_stream separately for stream and its phantom stream causes a NULL pointer dereference, since the phantom is destroyed on the first call. Skip the call for phantom streams. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Ilya Bakoulin <Ilya.Bakoulin@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Clamp VBIOS HDMI retimer register count to array sizeHarry Wentland
[Why & How] The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C register settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9] and dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated before use, so a malformed VBIOS can specify values up to 255, causing an out-of-bounds heap write during driver probe. Clamp each register count to the destination array size using min_t() before the copy loops, in both get_integrated_info_v11() and get_integrated_info_v2_1(). Assisted-by: GitHub Copilot:claude-opus-4.6 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Change default driver setting for "Force ODM2:1 for eDP" policyOvidiu Bunea
[Why & How] Change the driver setting: force single eDP ODM2:1 disable as default. Still allow user to enable it via debug option. Revert to unblock testing. Reviewed-by: Tom Chung <chiahsuan.chung@amd.com> Signed-off-by: Ovidiu Bunea <ovidiu.bunea@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()Harry Wentland
[Why & How] The aux_rd_interval array in struct dc_lttpr_caps is declared with MAX_REPEATER_CNT - 1 (7) elements, indexed 0..6. However, the offset parameter passed to dp_get_eq_aux_rd_interval() can be as large as MAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters via DPCD. This leads to an out-of-bounds read of aux_rd_interval[7] when offset is 8. Fix this by growing aux_rd_interval to MAX_REPEATER_CNT elements to accommodate the full range of valid repeater counts defined by the DP spec. Assisted-by: GitHub Copilot:Claude claude-4-opus Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Add DC_VALIDATE_MODE_AND_PROGRAMMING condition check for ↵Charlene Liu
force odm2:1 [Why & How] Need to limit force ODM 2:1 to DC_VALIDATE_MODE_AND_PROGRAMMING only, i.e. not block isCofunc check for topology mapping allowed. Reviewed-by: Ovidiu Bunea <ovidiu.bunea@amd.com> Signed-off-by: Charlene Liu <Charlene.Liu@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Check for sharpening case when calculating max vtaps for scalerSamson Tam
[Why & How] - calc_lb_num_partitions has check when scaler is not enabled to use larger LB in calculations for max vtaps based on viewport being 1:1 - however, scaler is forced on when sharpening is enabled, so need to consider this in check - taps is predetermined in spl_get_optimal_number_of_taps prior to calc_lb_num_partitions. Add check for taps not 1 to handle sharpening case Reviewed-by: Charlene Liu <charlene.liu@amd.com> Signed-off-by: Samson Tam <Samson.Tam@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Add DRAM table fields to clk_mgr_internalWenjing Liu
[Why] Add GPU-accessible DRAM buffer fields for bulk data transfer from PMFW during clock manager initialization. [How] Add dal_init_table and dal_init_table_addr fields to struct clk_mgr_internal for TABLE_DAL_INIT DRAM transfer. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Add DCN42 PMO init_for_pstate_supportDmytro Laktyushkin
[Why & How] Add pmo_dcn42_init_for_pstate_support mirroring the DCN4 FAMS2 version, but dropping the meta build for scheduling check that is unnecessary and skipping the cofunctionality check. This solves vrr validation issues in multidisplay configs. Reviewed-by: Dillon Varone <dillon.varone@amd.com> Signed-off-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Enable gcov coverage for amdgpu_dm KUnit buildsAlex Hung
[Why & How] Add GCOV_PROFILE := y to amdgpu_dm/Makefile under the CONFIG_DRM_AMD_DC_KUNIT_TEST guard so coverage instrumentation is only applied during KUnit builds, not all amdgpu_dm builds. Add coverage config options (CONFIG_GCOV, CONFIG_DEBUG_INFO, CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT, CONFIG_DEBUG_KERNEL) to tests/.kunitconfig so the kunit.py runner enables the kernel coverage configuration automatically. Assisted-by: Copilot:Claude-Sonnet-4.6 Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: add missing CSC entries for BT.2020 for DCE IPsLeorize
DCE-based hardware does not have the CSC matrices for BT.2020, which causes the driver to fallback to the GPU built-in matrices. This does not appear to cause any issues for RGB sinks, but causes major color artifacts for YCbCr ones (e.g. black becomes green). This commit adds the missing CSC matrices (taken from DC common) to DCE CSC tables, resolving the issue. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/3358 Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5333 Assisted-by: oh-my-pi:GPT-5.5 Signed-off-by: Leorize <leorize+oss@disroot.org> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Enable frame skipping in 0x37BChuntao Tso
[Why & How] Enable frame skipping in 0x37B Reviewed-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: Chuntao Tso <chuntao.tso@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Enable dcn42 pstate pmoDmytro Laktyushkin
[Why & How] Set a flag to enable pstate pmo, we want to always allow pstate support on dcn42 Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> Signed-off-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Enable DCN42 PMO policyNicholas Kazlauskas
[Why] The MinTTU policy in DML2.1 does not guarantee that we support p-state in blank. This is a delta vs dml2 and earlier revisions as the prefetch mode override has been removed in favor of a more configurable pstate optimizer. [How] The policy has been added in a prior patch, this patch enables it based on pmo flag. Reviewed-by: Dillon Varone <Dillon.Varone@amd.com> Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03drm/amd/display: Update get_pixel_clk_frequency() for DCN4x DCCG DP DTOOvidiu Bunea
[Why & How] DCN4x ASICs have different DCCG logic for programming DP DTO. The current get_pixel_clk_frequency_100hz() function does not account for this. Rename the function to "get_dp_dto_frequency" to more accurately reflect its intended behaviour. Create a new function that correctly calculates the target pixel rate for DCN4.x DCCG design and use it. Reviewed-by: Leo Chen <leo.chen@amd.com> Signed-off-by: Ovidiu Bunea <ovidiu.bunea@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-06-03iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failureStepan Ionichev
nxp_sar_adc_isr_buffer() bails on the first channel-read failure without calling iio_trigger_notify_done(), so the trigger use_count is left incremented and iio_trigger_poll_chained() drops subsequent dispatches until the device is rebound. Reaching this path means a state machine has gone wrong (driver bug or the SAR ADC in an unexpected state) rather than a transient bus issue, so this is hardening rather than a bug fix. If the underlying condition persists the device is wedged and needs an unbind anyway. Call iio_trigger_notify_done() on the error exit too, matching the success path. The nxp_sar_adc_read_notify() duplication is intentional and avoids a goto label for a two-line bail-out, as suggested by David. Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-03usb: host: xhci-rcar: Split R-Car Gen2 and Gen3 .plat_start() handlingGeert Uytterhoeven
Currently, R-Car Gen2 and Gen3 share the same .plat_start() callback. However, this single callback performs different operations, after checking the XHCI's controller compatible value. Avoid repeated checking of compatible values and reduce kernel size by splitting this method in two separate functions. Update xhci_rcar_resume_quirk() to dispatch to the correct method by calling it through the .plat_start() function pointer, too. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/d1ee4e1bb9106f8251b061b52948434d560b4675.1780499433.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03usb: host: xhci-rcar: Remove SET_XHCI_PLAT_PRIV_FOR_RCAR() macroGeert Uytterhoeven
The SET_XHCI_PLAT_PRIV_FOR_RCAR() macro does not add much value (there are only two users), and stands in the way of handling differences between R-Car Gen2 and Gen3. Remove it. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/a7083c3c822837556b91d845bd449c099db64769.1780499433.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03usb: xhci: allocate internal DCBAA mirror dynamicallyNiklas Neronin
Allocate the internal virtual device array dynamically based on the maximum number of slots reported by the host controller. Previously, the array was always allocated to the absolute maximum of 255 entries. Repurpose the 'MAX_HC_SLOTS' macro to limit the number of enabled slots. This mirrors how the maximum number of ports and interrupters are handled. The allocation now uses kcalloc_node(), which zeroes the memory automatically, making the explicit memset() call unnecessary. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-16-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03usb: xhci: allocate DCBAA based on host controller max slotsNiklas Neronin
Allocate the Device Context Base Address Array (DCBAA) according to the maximum number of device slots supported by the host controller, instead of always allocating the absolute maximum of 255 entries. The xHCI specification defines the DCBAA size as (MaxSlotsEnabled + 1) entries. In the xhci driver there is currently no distinction between MaxSlots and MaxSlotsEnabled, as all available slots are enabled during initialization. As a result, 'max_slots' effectively represents both values. This change allows the xHCI driver to respect custom slot limits, reduces unnecessary memory usage, and removes the obsolete "TODO" comment. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-15-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03usb: xhci: refactor DCBAA structNiklas Neronin
Embed the 'xhci_device_context_array' structure directly within 'xhci_hcd' instead of allocating it as a separate block. Only the array of device context addresses is now allocated separately. Since the device context addresses are no longer part of an array structure, rename 'dev_context_ptrs' to 'ctx_array' for clearer access semantics. Also remove the redundant comment next to the 'ctx_array' allocation; using dma_alloc_coherent() for 64-bit * N allocations guarantees both physically contiguous and properly aligned for 64-byte boundaries. The xHCI section (5.4.6) refers to DCBAAP instead of DCBAA (6.1). This change does not modify the number of host controller slots but simplifies memory management and prepares the driver for a variable number of HC slots in the future. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-14-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03xhci: Prevent queuing new commands if xhci is inaccessibleMathias Nyman
Refuse to queue a new command on the command ring if xHC is marked inaccessible with the HCD_FLAG_HW_ACCESSIBLE. HCD_FLAG_HW_ACCESSIBLE is set and cleared in suspend and resume. Also print a warning if xhci is being suspended with commands still pending on the command ring. Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-13-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03xhci: dbc: detect and recover hung DbC during enumeratonMathias Nyman
Add a timeout between the detection of the debug host connection and the DbC Run transition to ‘1’. Toggle the DCE bit to re-enable DbC in order to retry the debug device enumeration process if the DbC run transition takes too long. Set the timeout to 2 seconds See xhci specification section 7.6.4.1 "Debug Capability Initialization" Also detect cable disconnect during enable and connected state. Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-12-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03xhci: dbc: add timestamps to DbC state changes in a new helper.Mathias Nyman
The timestamp helps us track when a state changed the last time. It allows us to detect if DbC is stuck in connected state for too long, and can later be used to enable runtime suspend if there is no activity for some time Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-11-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03xhci: dbc: add helper to set and clear DbC DCE enable bitMathias Nyman
Add xhci_dbc_enable_dce() helper to enable or disable DbC by manipulating DCE bit correctly. It will be used for stuck DbC recovery attempts in addition to normal DbC enable and disable functionality Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-10-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03xhci: dbc: serialize enabling and disabling dbcMathias Nyman
DbC can be enabled and disabled via sysfs, serialize those with a mutex to make sure everything is done in the correct order. remove xhci_do_dbc_stop() and integrate the register write and dbc->state setting into xhci_do_stop() Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-9-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03xhci: dbc: Fix sysfs ABI Documentation for xhci dbc statesMathias Nyman
Reading the 'dbc' sysfs file won't return the "stalled" string anymore as "stalled" is no longer considered a DbC state since commit 9044ad57b60b ("xhci: dbc: Fix STALL transfer event handling") in 6.12 kernel. Remove it from sysfs-bus-pci-drivers-xhci_hcd ABI documentation Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-8-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03usb: xhci: Improve Soft Retries after short transfersMichal Pecio
A short transfer is a successful one, so reset the error count. Otherwise, endpoints which always complete short are limited to three retries per endpoint life rather than per URB. Signed-off-by: Michal Pecio <michal.pecio@gmail.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-7-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03usb: xhci: Remove isochronous URB_SHORT_NOT_OK handlingMichal Pecio
This URB flag was never supposed to have any effect on isoc endpoints. No kernel code uses the flag except usb_sg_init(), on non-isoc only. USBFS can't use it on isoc because proc_do_submiturb() rejects it. Signed-off-by: Michal Pecio <michal.pecio@gmail.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-6-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03usb: xhci: Remove skip_isoc_td()Michal Pecio
This function is pointless because usb_submit_urb() initializes all isoc frame descriptors to -EXDEV and 0 length so that HCDs don't need to do anything with transfers which were never executed. Other HCDs rely on this (e.g. EHCI itd_complete()), so we can too. This gets rid of a potentially dangereous function which could corrupt memory if we weren't super careful to only call it on isoc URBs. Also, set status to 0 rather than any random status determined by the later TD which caused skipping. This status will be ignored anyway. Signed-off-by: Michal Pecio <michal.pecio@gmail.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03usb: xhci: Simplify xhci_quiesce()Michal Pecio
The function reads USBCMD, clears some bits and writes it back. Its treatment of the Run bit is weird: the bit is usually written as 0, as we would expect, but it may also be written as 1 if both its current value and USBSTS.HCHalted are observed as 1. Per xHCI 5.4.2, HCHalted is 0 whenever Run is 1, so the above can only happen due to buggy HW or SW, e.g. concurrent xhci_quiesce() and xhci_start() execution. It's unclear why we should treat such cases specially and write the bit as 1. The logic comes from original PoC implementation and has never been explained. Just write 0 every time, which looks like the safer choice when the intent is to stop the xHC. We could get in trouble if clearing Run causes some very broken xHC to start running after it was halted, but no such case has been documented. It seems the logic was just poorly thought out. Signed-off-by: Michal Pecio <michal.pecio@gmail.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03usb: xhci: remove legacy 'num_trbs_free' trackingNiklas Neronin
Keeping track of free TRBs in a ring by adding and subtracting each time a enqueue or dequeue pointer is modified has proven to be buggy and complicated, especially over long periods of time. The xhci driver has already moved to calculating free TRBs dynamically based on ring size and the enqueue/dequeue positions. The DbC path is the last user of 'num_trbs_free'. Rather than maintaining two separate accounting mechanisms, remove the field entirely and switch DbC to use xhci_num_trbs_free(). Since 'num_trbs_free' undercounts by one, and xhci_num_trbs_free() does not, the check for sufficient free TRBs is adjusted. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03usb: xhci: fix typo in xhci_set_port_power() commentStepan Ionichev
Fix a spelling mistake (re-aquire -> re-acquire) in the function header comment. No functional change. Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260603091132.1110849-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-03dt-bindings: iio: adc: mt6359: Add MT6365 PMIC AuxADCLouis-Alexis Eyraud
Add compatible string for the AuxADC block found on the MT6365 PMIC, that is compatible with the one found in MT6359. Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Link: https://patch.msgid.link/20260429-mediatek-genio-mt6365-cleanup-v1-4-6f43838be92f@collabora.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-06-03dt-bindings: input: mediatek,pmic-keys: Add MT6365 supportLouis-Alexis Eyraud
Add compatible string for the pmic keys block found on the MT6365 PMIC, that is compatible with the one found in MT6359. Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Link: https://patch.msgid.link/20260429-mediatek-genio-mt6365-cleanup-v1-3-6f43838be92f@collabora.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-06-03drm/dumb-buffer: Drop buffer-size limits for nowThomas Zimmermann
The size limits break some of the CI tests. So drop them for now. Keep the other overflow tests from commit 5ab62dd3687b ("drm: prevent integer overflows in dumb buffer creation helpers") in place. There is still a pre-existing overflow check for 32-bit type limits in drm_mode_create_dumb() that will catch the really absurd size requests. Drivers that still do not use drm_mode_size_dumb() should be updated. The helper calculates dumb-buffer geometry with overflow checks. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Fixes: 5ab62dd3687b ("drm: prevent integer overflows in dumb buffer creation helpers") Reported-by: Jani Nikula <jani.nikula@linux.intel.com> Closes: https://lore.kernel.org/dri-devel/ddf0233e50044059c85279f928661563ef6a55bf@intel.com/ Cc: Rajat Gupta <rajat.gupta@oss.qualcomm.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Maxime Ripard <mripard@kernel.org> Acked-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260602112842.252279-1-tzimmermann@suse.de
2026-06-03irqchip/qcom-pdc: Use FIELD_GET() to extract bank index and bit positionMukesh Ojha
The IRQ_ENABLE_BANK register is a bank of 32-bit words where each bit represents one PDC pin. The bank index and bit position within the bank are encoded in the flat pin number as bits [31:5] and [4:0] respectively. Replace the open-coded division and modulo with FIELD_GET() and GENMASK() to make the bit extraction self-documenting and consistent with the FIELD_PREP() style already used in the PDC_VERSION() macro. Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://patch.msgid.link/20260527095426.2324504-5-mukesh.ojha@oss.qualcomm.com
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-15 17:18:28 +0000