summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-08-01Merge tag 'drm-intel-next-2026-07-28' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-next drm/i915 feature pull #2 for v7.3: Features and functionality: - Enable UHBR link rates on Thunderbolt tunneled links (Imre) - Reduce Xe3+ PM demand peak bandwidth for power savings (Vinod) - Add the blend mode property to all planes that support alpha blending (Chaitanya) - Enable pipe DMC error interrupts for display 30+ (Dibin) - Add KUnit tests for DP link config selection and fallback (Imre) Refactoring and cleanups: - Refactor DP link config selection and unify across use cases (Imre) - Unify i915 and xe display runtime PM calls (Jani) - Refactor BIOS framebuffer takeover (Ville) Fixes: - Fix HD audio on DP UHBR SST (Kai Vehmanen) - Fixes to xe driver BIOS framebuffer takeover (Ville) - Fix 2 pixels-per-clock CDCLK calculation to avoid underruns (Ville) - Fix incorrectly set VSC SDP Main Stream Attribute (Chaitanya) - Fix BPC and DSC selection for HDMI sinks (Alexander Kaplan) - Fix PCON max FRL rate selection (Alexander Kaplan) - Workaround Xe3P PSR2 screen corruption (Dibin) - Fix NVL A & B stepping vtotal setting (Suraj) - Fix xe DPT allocation paths (Maarten) - Prefer system memory instead of stolen for new framebuffers in xe (Maarten) - Fix transcoder mask sizes (John Harrison) - Clear stale UV/Y plane DDB entries on plane disable (Vinod) - Fix some DP AUX backlight control issues, again (Suraj) - Fix switching between HDCP 1.4 and 2.2 authentication (Suraj) - Remove unnecessary Xe2_LPD+ FBC plane width and surface size limits (Vinod) - Ensure non-zero DSB safe window for PTL+ (Ankit) - Fix bandwidth calculation to account for 16 DRAM channels (Uma) - Fix NV12 ceiling division for bigjoiner case (Vidya) DRM core changes: - Add Thunderbolt UHBR tunneling support (Imre) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/cb1b5a644d75589cbcdcc8ec8160968140426439@intel.com
2026-07-31mshv_vtl: bounds-check cpu index in vtl mmap fault handlerYi Xie
cpu is taken from pgoff & 0xffff. cpu_online() does not reject cpu >= nr_cpu_ids, and per_cpu_ptr() can then walk off __per_cpu_offset. Signed-off-by: Yi Xie <xieyi@kylinos.cn> Reviewed-by: Naman Jain <namjain@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31mshv: Publish VP to pt_vp_array before installing the file descriptorStanislav Kinsburskii
mshv_partition_ioctl_create_vp() called anon_inode_getfd() before publishing the new VP into partition->pt_vp_array. anon_inode_getfd() includes fd_install(), so the fd was live in current->files before the publish ran. A concurrent MSHV_RUN_VP ioctl on that fd does not serialise against the in-progress MSHV_CREATE_VP — it takes vp->vp_mutex, not the partition mutex. Once the VP starts running and traps, mshv_intercept_isr() can look up partition->pt_vp_array[vp_index] and observe NULL, silently dropping the intercept message. Split the fd creation: reserve an fd with get_unused_fd_flags(), create the file with anon_inode_getfile(), publish the VP via smp_store_release(), and finally call fd_install() as the userspace-visibility commit point. Fixes: 621191d709b14 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31Drivers: hv: vmbus: add VTL2 redirect connection IDHardik Garg
VMBus sends CHANNELMSG_INITIATE_CONTACT through a Hyper-V message connection ID. Older protocol versions use VMBUS_MESSAGE_CONNECTION_ID, while protocol version 5.0 and newer normally use VMBUS_MESSAGE_CONNECTION_ID_4. For a VTL2 kernel using VMBus protocol 5.0 or newer, the host may expect INITIATE_CONTACT on either the redirect connection ID or VMBUS_MESSAGE_CONNECTION_ID_4. There is no capability indication that identifies which ID is active, so the driver must determine it at runtime. During VMBus negotiation, the redirect ID is tried first because it is used by VTL2 configurations with VMBus redirection enabled. If the redirect ID is unavailable, the host rejects it synchronously with HV_STATUS_INVALID_CONNECTION_ID, allowing fallback to the standard ID. Return a distinct error for an invalid Initiate Contact connection ID so this fallback does not mask other post-message failures or protocol-version rejections. Preserve the existing connection ID selection for older protocol versions or when running below VTL2. Signed-off-by: Hardik Garg <hargar@linux.microsoft.com> Reviewed-by: Tianyu Lan <Tianyu.Lan@microsoft.com> Reviewed-by: Saurabh Sengar <ssengar@linux.microsoft.com> Reviewed-by: Naman Jain <namjain@linux.microsoft.com> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31mshv: Order pt_vp_array publish against irqfd assertion pathStanislav Kinsburskii
mshv_partition_ioctl_create_vp() initialises a VP struct (allocations, mutex_init, init_waitqueue_head, page mappings) and then publishes the pointer into partition->pt_vp_array. Several ISR paths read this array locklessly: the intercept ISR, the two scheduler ISRs, and mshv_try_assert_irq_fast() on the irqfd fast path. Of these, only mshv_try_assert_irq_fast() can structurally race the publish. It runs from an eventfd waker without holding pt_mutex, and MSHV_IRQFD does not require the target lapic_apic_id (== vp_index) to refer to an existing VP at registration time. A user can therefore register an irqfd targeting a yet-to-be-created VP, then trigger mshv_try_assert_irq_fast() concurrently with MSHV_CREATE_VP for the same index. On weakly-ordered architectures the reader can observe a non-NULL pointer in pt_vp_array before the initialising stores to the VP struct become visible, leading to use of partially-initialised fields (e.g. vp_register_page). The other ISR readers cannot reach this race: the hypervisor will not generate intercept or scheduler messages for a VP that has never been told to run, and the user can only call MSHV_RUN_VP on the VP fd returned by MSHV_CREATE_VP, which by construction is returned after the publish. Leave those readers as plain loads. Use smp_store_release() in mshv_partition_ioctl_create_vp() to publish the pointer, and pair it with smp_load_acquire() in mshv_try_assert_irq_fast(). On x86 these compile to plain accesses under TSO; on ARM64 they emit one-instruction acquire/release barriers, acceptable on this fast path. The destroy-side path (destroy_partition() clearing pt_vp_array[i] to NULL after kfree(vp)) has a separate ordering and lifetime concern that is out of scope here. Fixes: 621191d709b14 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31mshv: Fix missing error code on VP allocation failureStanislav Kinsburskii
In mshv_partition_ioctl_create_vp(), when kzalloc for the VP struct fails, the code jumps to the cleanup path without setting ret. At that point ret is 0 from the preceding successful mshv_vp_stats_map() call, so the function returns success to userspace despite having failed to create the VP. No fd is installed and no VP is registered in pt_vp_array, but userspace has no way to know the operation failed. Set ret to -ENOMEM before jumping to the cleanup path. Fixes: 621191d709b14 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31mshv: Fix level-triggered check on uninitialized dataStanislav Kinsburskii
In mshv_irqfd_assign(), the level-triggered validation for resample irqfds checks irqfd_lapic_irq.lapic_control.level_triggered before mshv_irqfd_update() has populated the field. Since the irqfd struct is zero-allocated, level_triggered is always 0 at that point, causing the check to always reject resample irqfds with -EINVAL. This makes level-triggered interrupt resampling — used to avoid interrupt storms with assigned devices — completely non-functional. Move the check after the mshv_irqfd_update() call, which resolves the IRQ routing entry and populates irqfd_lapic_irq with the actual trigger mode. Fixes: 621191d709b14 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31mshv: Fix race in mshv_irqfd_deassignStanislav Kinsburskii
mshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list require pt->pt_irqfds_lock to be held, but mshv_irqfd_deassign() omits it. This races with the EPOLLHUP path in mshv_irqfd_wakeup(), which does take the lock before calling mshv_irqfd_deactivate(). Additionally, mshv_irqfd_deactivate() uses hlist_del() which poisons the node pointers rather than resetting them. Since mshv_irqfd_is_active() relies on hlist_unhashed() (checks pprev == NULL), a poisoned node still appears active. If a concurrent path calls mshv_irqfd_deactivate() again on the same irqfd, the guard fails to prevent a double hlist_del() on poisoned pointers. Fix both issues: - Add the missing spin_lock_irq/spin_unlock_irq around the list traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release(). - Use hlist_del_init() instead of hlist_del() so the node is properly marked as unhashed after removal, making the is_active guard reliable. Fixes: 621191d709b14 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31mshv: Use kfree_rcu in mshv_portid_freeStanislav Kinsburskii
mshv_portid_free() uses synchronize_rcu() followed by kfree() to reclaim port table entries. This blocks the caller until a full RCU grace period elapses, which is unnecessary since the same module already uses the non-blocking kfree_rcu() pattern in mshv_port_table_fini(). Replace with kfree_rcu() to avoid the blocking wait and keep the reclamation strategy consistent across the file. Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31Merge tag 'spi-fix-v7.2-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "The drip of driver specific fixes, mostly from the device vendors themselves, keeps on coming in. There's more than I'd like right now but equally nothing hugely alarming" * tag 'spi-fix-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-nxp-fspi: propagate clock reconfig failures in nxp_fspi_select_mem() spi: spi-nxp-fspi: enter stop mode before reconfiguring MCR0 and DLL spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs spi: spi-qpic-snand: write the feature value before executing SET_FEATURE spi: spi-cadence: Move TX FIFO full busy-wait into FIFO spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure spi: spacemit: prepare both DMA descriptors before submitting
2026-07-31accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()Lizhi Hou
Two error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma) before returning an error code to the caller. This is incorrect: amdxdna_gem_obj_mmap() registers an HMM interval notifier before calling amdxdna_insert_pages(), and on a hard error it jumps to hmm_unreg to undo that registration. Calling vm_ops->close() manually — which drops the shmem pages_pin_count and the GEM object reference that backs the VMA — before the mmap syscall has even returned causes those resources to be released while the VMA is still alive. The kernel VMA teardown will call vm_ops->close() a second time when the process later unmaps the range, producing a reference count underflow. Replace both hard-error returns with a deferred-fault approach that keeps the VMA alive and retries page insertion through the HMM range-fault path. Fixes: e486147c912f ("accel/amdxdna: Add BO import and export") Reviewed-by: Max Zhen <max.zhen@amd.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260723074256.2435143-1-lizhi.hou@amd.com
2026-07-31regulator: fp9931: Fix VPOS/VNEG voltage selector tableRobby Cai
The VPOSNEG_table[] mapping does not match the FP9931 datasheet. The datasheet defines the VPOS/VNEG voltage mapping as: 00h-04h -> 7.04V (-7.04V) 05h -> 7.26V (-7.26V) 06h -> 7.49V (-7.49V) ... 28h-3Fh -> 15.06V (-15.06V) However, VPOSNEG_table[] has two issues: 1. Selector 0x00~0x04 should all map to 7.04V (5 entries), but the table has 6 entries of 7.04V, causing all subsequent entries to be shifted by one position. 2. Selectors 0x29~0x3F should all clamp to 15.06V (23 entries), but the table has only 41 entries. Any selector value above 0x28 would result in an out-of-bounds table access. Fix both issues by removing the duplicate 7.04V entry and appending the missing 23 clamped 15.06V entries, bringing the table to the correct size of 64 entries (0x00~0x3F). Fixes: 12d821bd13d4 ("regulator: Add FP9931/JD9930 driver") Signed-off-by: Robby Cai <robby.cai@nxp.com> Link: https://patch.msgid.link/20260724103441.800522-2-robby.cai@oss.nxp.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-31Merge tag 'amd-pstate-v7.3-2026-07-30' of ↵Rafael J. Wysocki
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux Pull amd-pstate 7.3 content (07/30/26) from Mario Limonciello: "* Changes for dynamic EPP * Adjustments to the bios min perf feature * Fixes to kernel doc" * tag 'amd-pstate-v7.3-2026-07-30' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux: cpufreq/amd-pstate: Document missing kernel-doc members cpufreq/amd-pstate-ut: Add unit test for CPPC Performance Priority cpufreq/amd-pstate-ut: Add unit test for "dynamic" EPP mode cpufreq/amd-pstate: Reduce the scope of exported symbols Documentation/amd-pstate: Update dynamic_epp documentation with new behavior cpufreq/amd-pstate: Remove "amd_dynamic_epp" cmdline and "dynamic_epp" sysfs cpufreq/amd-pstate: Add dynamic EPP as an "energy_performance_preference" mode cpufreq/amd-pstate: Extract platform profile to EPP conversion into a helper cpufreq/amd-pstate: Remove the defensive check for bios_min_perf cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf
2026-07-31cpufreq: intel_pstate: Adjust policy->cur in active mode to policyRafael J. Wysocki
Since arch_freq_get_on_cpu() on x86 falls back to cpufreq_quick_get(), which effectively causes policy->cur to be returned when intel_pstate is used, adjust intel_pstate_set_policy() to set policy->cur to reflect the P-state that is actually going to be requested in the "performance" policy case instead of setting it to policy->min (which is confusing because it causes scaling_cur_freq to show the minimum frequency while the CPU is likely running at the maximum one). For this purpose, rearrange intel_pstate_set_policy() to handle the HWP case separately, to avoid calling intel_pstate_set_pstate() pointlessly with HWP enabled, and use the observation that with HWP enabled in the active mode, the utilization update hook is only needed when HWP boost is used and the policy is not "performance". Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Doug Smythies <dsmythies@telus.net> Tested-by: Doug Smythies <dsmythies@telus.net> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://patch.msgid.link/5144014.31r3eYUQgx@rafael.j.wysocki
2026-07-31Merge tag 'pci-v7.2-fixes-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Remove Karthikeyan Mitran from Mobiveil MAINTAINERS PCIe entry since email bounces (Manivannan Sadhasivam) - Preserve i.MX6Q, i.MX6QP, and i.MX6SX Root Port MSI/MSI-X Capabilities when using iMSI-RX to work around hardware defect (Soeren Moch) - Reorder i.MX6Q/DL PHY power up to fix boot hang regression (Richard Zhu) * tag 'pci-v7.2-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: imx6: Fix i.MX6Q/DL boot hang caused by improper PHY power sequencing PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work around hardware bug MAINTAINERS: Drop Karthikeyan Mitran from Mobiveil PCIe entry
2026-07-31PCI/ERR: Add support for resetting the Root Ports in a platform-specific wayManivannan Sadhasivam
Some host bridge devices require resetting the Root Ports in a platform specific way to recover them from error conditions such as Fatal AER errors, Link Down, etc. Introduce pci_host_bridge::reset_root_port() callback and call it from pcibios_reset_secondary_bus() if available. Also, save the Root Port config space before reset and restore it afterwards. The .reset_root_port() callback is responsible for resetting the given Root Port referenced by the 'pci_dev' pointer in a platform-specific way and bring it back to the working state if possible. If any error occurs during the reset operation, relevant errno should be returned. Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Brian Norris <briannorris@chromium.org> Tested-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Tested-by: Richard Zhu <hongxing.zhu@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260729-pci-port-reset-v9-2-53570b92064d@oss.qualcomm.com
2026-07-31Merge tag 'hwmon-for-v7.2-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "Most of the patches are fixes for pre-existing issues reported by Sashiko. I suspect we'll see a lot of those for a while. - adt7470: - Fix PWM auto temp state array and bounds check - Fix divide-by-zero TOCTOU crash in fan speed read - Use cached PWM frequency value - Fix swapped PWM3 and PWM4 auto mode masks - Fix temperature alarm logic in hwmon_temp_read() - Fix busy-loop and I2C flooding in update thread - Fix cache updated before hardware write on I2C error - Fix fans stuck in manual mode on I2C errors - ina2xx: Fix various overflow issues - ltc4282: Fix reading the minimum alarm voltage - lm63: Mask PWM frequency multiplier to supported bits - lm90: Only report alarms if driver is ready - nct6775-core: - Prevent access to unsupported weight registers - Fix number of temperature registers for NCT6116 - npcm750-pwm-fan: stop fan timer on device detach - nzxt-smart2: DMA-align output buffer - pmbus: - Fix return value from pmbus_update_byte_data() - Notify on the hwmon device, not the i2c client - sht3x: Fix unaligned accesses" * tag 'hwmon-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (npcm750-pwm-fan): stop fan timer on device detach hwmon: (pmbus) Fix return value from pmbus_update_byte_data() hwmon: (adt7470) Fix PWM auto temp state array and bounds check hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read hwmon: (adt7470) Use cached PWM frequency value hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread hwmon: (adt7470) Fix cache updated before hardware write on I2C error hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors hwmon: (nct6775-core) Prevent access to unsupported weight registers hwmon: (lm63) Mask PWM frequency multiplier to supported bits hwmon: (nzxt-smart2) DMA-align output buffer hwmon: (lm90) Only report alarms if driver is ready hwmon: (sht3x) Fix unaligned accesses hwmon: (ltc4282) Fix reading the minimum alarm voltage hwmon: (ina2xx) Fix various overflow issues hwmon: (pmbus/core) notify on the hwmon device, not the i2c client hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
2026-07-31PCI: qcom: Clear Attention Button Present in Slot CapabilitiesQiang Yu
Qcom PCIe Root Ports advertise the Attention Button Present (ABP) bit in the Slot Capabilities register, but the slots have no attention button. When ABP is set, pcie_enable_notification() in the pciehp driver enables the Attention Button Pressed interrupt (ABPE) and leaves the Presence Detect Changed interrupt (PDCE) disabled. As a result, presence detect changes are never reported, and surprise hot-plug detection that relies on Presence Detect Changed events does not work. Clear the Attention Button Present (ABP) bit in the Slot Capabilities register so pciehp Presence Detect Changed events work. Signed-off-by: Qiang Yu <qiang.yu@oss.qualcomm.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> [bhelgaas: say what the patch does in the commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> # X1E80100 CRD Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://patch.msgid.link/20260713-b4-clear_abp_0713-v2-2-4f0333a98d4e@oss.qualcomm.com
2026-07-31perf/dwc_pcie: Support narrowed time-based counter for long time monitoringYufan Dou
The DWC PCIe Time-Based Analysis Data Register (the counter for time-based events) is architected as 64-bit, but some hardware implementations do not implement the full width. On these implementations the counter stops after reaching its implemented width. This will limit the usage for short time monitoring only. The counter will only cover ~15s for monitoring RX TLP payloads on our platform. Add an optional hrtimer that fires every 2 seconds. It'll take the role as the counter overflow interrupt to read-update-reset the counter and event counts to break the limits of the narrow counters. It'll only apply on timer-based counter. The 2 seconds update period is the half of the maximum counting period (4s) of the time-based counter under period counting mode of the hardware. Because fully-implemented 64-bit counters do not need this workaround, enable this hrtimer on the platforms known to have narrowed counter. Before this patch, when counting fio for 10m the counts is incorrect: root@localhost:/tmp# perf stat -e dwc_rootport_20000/rx_pcie_tlp_data_payload/ -- fio --runtime=10m fio_job.config [...] Run status group 0 (all jobs): READ: bw=5594MiB/s (5865MB/s), 5594MiB/s-5594MiB/s (5865MB/s-5865MB/s), io=3278GiB (3519GB), run=600010-600010msec [...] Performance counter stats for 'system wide': 137,438,953,456 dwc_rootport_20000/rx_pcie_tlp_data_payload/ After this patch the counts is as expected: root@localhost:/tmp# perf stat -e dwc_rootport_20000/rx_pcie_tlp_data_payload/ -- fio --runtime=10m fio_job.config [...] Run status group 0 (all jobs): READ: bw=5632MiB/s (5905MB/s), 5632MiB/s-5632MiB/s (5905MB/s-5905MB/s), io=3300GiB (3543GB), run=600013-600013msec [...] Performance counter stats for 'system wide': 3,543,850,268,576 dwc_rootport_20000/rx_pcie_tlp_data_payload/ Signed-off-by: Yufan Dou <douyufan@picoheart.com> Signed-off-by: Yicong Yang <yang.yicong@picoheart.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-31regulator: handle regulator late cleanup race with PM suspendMark Brown
Joy Zou <joy.zou@oss.nxp.com> says: The regulator_init_complete_work fires ~30s after boot to disable unused regulators via I2C. When this work races with PM suspend, the I2C adapter may already be suspended, causing a -ESHUTDOWN warning dump. This series addresses the race and adds proper suspend power management for unused LDO regulators. Link: https://patch.msgid.link/20260731-b4-regulator-pf01-v2-0-a406c8737fdb@oss.nxp.com
2026-07-31regulator: pfuze100: add set_suspend_disable for LDO opsJoy Zou
Add a set_suspend_disable callback to pfuze100_ldo_regulator_ops to support the regulator-off-in-suspend DTS property for the VGEN LDO regulators. This allows unused LDO regulators to be properly disabled during system suspend, reducing power consumption. The callback is only used by the LDO ops, so name it accordingly: pfuze100_ldo_set_suspend_disable. It uses the per-regulator stby_reg/stby_mask that already describe the standby control for each LDO, so it works for every LDO covered by these ops. Signed-off-by: Joy Zou <joy.zou@oss.nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260731-b4-regulator-pf01-v2-2-a406c8737fdb@oss.nxp.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-31regulator: core: use system_freezable_wq for init complete workJoy Zou
schedule_delayed_work() uses system_wq, which is non-freezable, allowing regulator_init_complete_work to run concurrently with system suspend. This work fires ~30s after boot to disable unused regulators via I2C. When it races with PM suspend, the I2C adapter may already be suspended, triggering a -ESHUTDOWN warning in __i2c_transfer(): WARNING: ... at __i2c_transfer+0x36c/0x3c8 Call trace: __i2c_transfer i2c_transfer regmap_i2c_write _regmap_update_bits regulator_disable_regmap _regulator_do_disable regulator_late_cleanup regulator_init_complete_work_function process_one_work Switch to system_freezable_wq so the work is frozen before any device is suspended, eliminating the race. Fixes: 55576cf18537 ("regulator: Defer init completion for a while after late_initcall") Signed-off-by: Joy Zou <joy.zou@oss.nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260731-b4-regulator-pf01-v2-1-a406c8737fdb@oss.nxp.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-31soc/tegra: Add PM dependency to SOC_TEGRA_PMC KconfigSasha Levin
kconfiglint reports: K006: config SOC_TEGRA_PMC selects PM_GENERIC_DOMAINS which depends on PM, but SOC_TEGRA_PMC does not depend on PM SOC_TEGRA_PMC is an internal bool symbol (no prompt) that is selected by ARCH_TEGRA_*_SOC options to enable the Power Management Controller driver. It was originally introduced in commit 5e7d4c652941 ("soc/tegra: Implement Tegra186 PMC support") as a bare `bool` with no selects of its own. Over time, additional selects were added: - Commit 5098e2b95e8e ("soc/tegra: pmc: Select GENERIC_PINCONF") added select GENERIC_PINCONF - Commit 28dbe8231066 ("soc/tegra: pmc: Select IRQ_DOMAIN_HIERARCHY") added select IRQ_DOMAIN_HIERARCHY - Commit f880ee9e9688 ("soc/tegra: pmc: Add core power domain") added select PM_OPP and select PM_GENERIC_DOMAINS to support core power domain voltage scaling PM_GENERIC_DOMAINS is defined in kernel/power/Kconfig as: config PM_GENERIC_DOMAINS bool depends on PM When commit f880ee9e9688 ("soc/tegra: pmc: Add core power domain") added the select, it did not add a corresponding `depends on PM` to SOC_TEGRA_PMC. This was not a functional problem because all callers of SOC_TEGRA_PMC are inside `if ARCH_TEGRA` blocks, and both the ARM32 definition (arch/arm/mach-tegra/Kconfig) and the ARM64 definition (arch/arm64/Kconfig.platforms) of ARCH_TEGRA select PM. Thus PM is always enabled when SOC_TEGRA_PMC is selected in practice. However, the dependency chain is implicit rather than explicit. Add `depends on PM` to SOC_TEGRA_PMC to make the requirement explicit and prevent a theoretical misconfiguration if SOC_TEGRA_PMC were ever selected outside the ARCH_TEGRA context. Assisted-by: Claude:claude-opus-4-6 kconfiglint Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Thierry Reding <treding@nvidia.com>
2026-07-31soc/tegra: fuse: Use device-specific instance in suspend/resumeKartik Rajput
Avoid using the default fuse instance in suspend/resume callbacks, as it always runs the suspend/resume callbacks for the default instance rather than the device’s own. Get the correct fuse instance by using `dev_get_drvdata()`. Signed-off-by: Kartik Rajput <kkartik@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
2026-07-31soc/tegra: fuse: Do not use fuse data as entropy sourceKartik Rajput
Fuse values are static and device-unique but not secret. Using them as an entropy source weakens the overall randomness pool because the data is constant and externally observable over the device’s lifetime. Stop feeding fuse data into the kernel’s randomness subsystem. Signed-off-by: Kartik Rajput <kkartik@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
2026-07-31soc/tegra: cbb: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
2026-07-31perf: marvell: Cancel CN10K DDR PMU hrtimer on device removeGeetha sowjanya
cn10k_ddr_perf_remove() did not cancel the poll hrtimer before returning. If the device was unbound while perf events were still active the timer callback could run post-free. To fix the issue by adding hrtimer_cancel() in remove(). Signed-off-by: Geetha sowjanya <gakula@marvell.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-31perf: marvell: Add CN20K DDR PMU supportGeetha sowjanya
The CN20K DRAM Subsystem exposes eight programmable performance counters and two fixed counters for DDR read and write traffic. Software selects events for the programmable counters from traffic at the DDR PHY interface, the CHI interconnect, or inside the DDR controller. Add CN20K register offsets, event maps, and sysfs attributes; match the device via OF (marvell,cn20k-ddr-pmu) and ACPI (MRVL000B). Represent the SoC variant in platform data with bit flags so CN20K can reuse the CN10K PMU code path where appropriate. Signed-off-by: Geetha sowjanya <gakula@marvell.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-31wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsetsDoruk Tan Ozturk
ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from assoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower bound. The aggregate check recently added to ath6kl_wmi_connect_event_rx() bounds the declared lengths from above (their sum must fit the received event), but an assoc request/response shorter than its fixed offset still underflows here: the u8 wraps to ~250, and cfg80211_connect_result() / cfg80211_roamed() then treat that wrapped value as the IE length and copy that many bytes out of the small assoc_info buffer to user space via nl80211, disclosing adjacent slab memory. Clamp both lengths to their offsets before subtracting. Found by 0sec (https://0sec.ai) using automated source analysis; the missing lower bound is evident from source. Compile-tested. Fixes: bdcd81707973 ("Add ath6kl cleaned up driver") Cc: stable@vger.kernel.org Assisted-by: 0sec:claude-opus-4-8 Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai> Link: https://patch.msgid.link/20260713213251.21161-1-doruk@0sec.ai Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-31wifi: ath11k: fix leak in ath11k_service_ready_ext_event()Jeff Johnson
Currently, during ath11k_service_ready_ext_event() processing, svc_rdy_ext.mac_phy_caps can be allocated during TLV parsing. This is a temporary allocation that is freed on the success path, but not on the error path. If parsing succeeds far enough to allocate mac_phy_caps and then fails on a later TLV, the allocation leaks. So free the allocation on the error path. Compile tested only. Fixes: 5b90fc760db5 ("ath11k: fix wmi service ready ext tlv parsing") Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260727-ath11k_service_ready_ext_event-memleak-v1-1-e8373d27bdd1@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-31wifi: ath11k: fix resource leak on error in ext IRQ setupZhaoJinming
In ath11k_ahb_config_irq(), when a CE request_irq() fails, the function returns the error immediately without freeing the CE IRQs that were successfully registered in previous loop iterations. The probe error path does not call ath11k_ahb_free_irq() either, so the previously registered CE IRQ handlers remain attached to the interrupt lines and are never released. In ath11k_ahb_config_ext_irq(), when an external request_irq() fails, the error is only logged and the loop continues. The function then returns 0 indicating success, leaving the device in a partially configured state where some external IRQs are not registered. This causes enable_irq()/disable_irq()/free_irq() to be called on unregistered IRQs during runtime and remove/shutdown, triggering WARN_ON(!desc->action), and missing interrupt handlers lead to data loss. Additionally, if alloc_netdev_dummy() fails for a later IRQ group, the function returns -ENOMEM without freeing the ext IRQs and napi_ndev that were successfully set up for earlier groups. Fix all three issues: propagate the error up to the caller and unwind all successfully registered IRQs and allocated resources on failure. Also move ab->irq_num[irq_idx] assignment after request_irq() succeeds in the ext IRQ path to match the CE IRQ path and avoid storing a stale IRQ number on failure. Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260729020005.219253-1-zhaojinming@uniontech.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-31Revert "thermal: hwmon: Register a hwmon device for each thermal zone"Rafael J. Wysocki
Revert commit d6323469bcfb ("thermal: hwmon: Register a hwmon device for each thermal zone") that changed the names of hwmon class devices associated with thermal zones and their sysfs layout which made user space unhappy. Closes: https://lore.kernel.org/linux-pm/cafd8af9-c6e9-4bf2-b496-23e796fbc9a6@linux.dev/ Closes: https://lore.kernel.org/linux-hwmon/ab8b093b-46e6-4738-afcf-4b97c9ad5af9@googlemail.com/ Cc: stable@vger.kernel.org Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2301040.irdbgypaU6@rafael.j.wysocki
2026-07-31Revert "thermal: hwmon: Use extra_groups for adding temperature attributes"Rafael J. Wysocki
Revert commit cfb5dc0f60fb ("thermal: hwmon: Use extra_groups for adding temperature attributes") because it is depended on by another one that turned out to be problematic. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/1992232.tdWV9SEqCh@rafael.j.wysocki
2026-07-31s390/dasd: Fix undersized format-check bufferStefan Haberland
fmt_buffer_size in dasd_eckd_check_device_format() is declared as int, even though one of the multiplicands, sizeof(struct eckd_count), is a size_t. The expression trkcount * rpt_max * sizeof(struct eckd_count) is therefore correctly evaluated at 64-bit width, but the result is silently truncated when it is stored back into the 32-bit fmt_buffer_size variable. For a sufficiently large track range (start_unit/stop_unit are caller-controlled) this truncation yields a buffer size far smaller than the number of tracks actually requested. kzalloc() then succeeds with an undersized allocation, while the subsequent channel program build still operates on the untruncated track count and writes past the end of that buffer. Compute the buffer size with check_mul_overflow() and keep it in a size_t, so that a value that no longer fits results in -EINVAL instead of a silently truncated allocation size. Fixes: 8fd575200db5 ("s390/dasd: Add new ioctl BIODASDCHECKFMT") Cc: stable@vger.kernel.org #4.7 Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com> Signed-off-by: Stefan Haberland <sth@linux.ibm.com> Link: https://patch.msgid.link/20260727142840.567286-4-sth@linux.ibm.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-07-31s390/dasd: Fix potential NULL pointer dereferenceJan Höppner
dasd_release_space() checks the implementation of the is_ese() discipline function before calling it to determine if a given device is an ESE DASD. The current usage of the logical AND operator will lead to a NULL pointer dereference as the function is called even if the function pointer is NULL. Fix this by using the logical OR operator. Fixes: 91dc4a197569 ("s390/dasd: Add new ioctl to release space") Cc: stable@vger.kernel.org # v5.3+ Reported-by: Vasily Gorbik <gor@linux.ibm.com> Acked-by: Eduard Shishkin <edward6@linux.ibm.com> Reviewed-by: Stefan Haberland <sth@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com> Signed-off-by: Stefan Haberland <sth@linux.ibm.com> Link: https://patch.msgid.link/20260727142840.567286-3-sth@linux.ibm.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-07-31s390/dasd: Fix path verification interrupted by concurrent ↵Stefan Haberland
dasd_sleep_on_immediatly When all channel paths to a DASD device are lost and subsequently recovered, the path event handler starts one IO per path via dasd_sleep_on_immediatly() to execute read configuration data (RCD) with high priority. dasd_sleep_on_immediatly() works by terminating the currently running request before inserting the new request. If a concurrent caller, such as the attention handler dasd_eckd_check_attention_work() or the summary unit check handler summary_unit_check_handling_work(), also calls dasd_sleep_on_immediatly() while a path verification RCD is in progress, the RCD gets terminated. The problem is that a terminated request transitions from CLEARED to TERMINATED without going through the normal retry path in __dasd_device_process_ccw_queue. The RCD therefore returns -EIO, and the affected paths remain non-operational after recovery. RCD CQRs used for path verification already carry the DASD_CQR_VERIFY_PATH flag. Extend _dasd_term_running_cqr() to check this flag: instead of terminating such a request, return -EAGAIN. In dasd_sleep_on_immediatly(), loop on -EAGAIN with a short sleep, waiting for the path verification request to complete before inserting the new request. This is consistent with the already indefinite wait_event() that dasd_sleep_on_immediatly() uses for its own request, and all other callers (attention handler, summary unit check handler, reserve/release/steal-lock) benefit automatically without requiring changes. Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com> Signed-off-by: Stefan Haberland <sth@linux.ibm.com> Link: https://patch.msgid.link/20260727142840.567286-2-sth@linux.ibm.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-07-31Merge back cpufreq material for 7.3Rafael J. Wysocki
* pm-cpufreq: cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks cpufreq/amd-pstate: Cache the firmware programmed EPP value cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems cpufreq/amd-pstate: Fix EPP return type and handle errors during initialization cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active cpufreq: schedutil: Replace sprintf() with sysfs_emit() in sysfs show cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() Documentation: admin-guide: cpufreq: fix sampling_rate example command cpufreq: intel_pstate: Move two functions closer to callers cpufreq: intel_pstate: Consolidate frequency values computation cpufreq: intel_pstate: Introduce intel_pstate_update_freq_limits() cpufreq: intel_pstate: Fix setting minimum P-state at init time cpufreq: intel_pstate: Rename INTEL_PSTATE_HWP_BROADWELL cpufreq: intel_pstate: Simplify HWP handling on Broadwell cpufreq: intel_pstate: Adjust the .adjust_perf() driver callback cpufreq: intel_pstate: Rearrange checks in hybrid_get_cost()
2026-07-31watchdog: bd96801_wdt: Fix timeout for enabled WDGMatti Vaittinen
When watchdog is enabled at the probe time, the bd96801 driver retrieves the timeout configuration from the registers to set-up the heart-beat values. As Sashiko pointed out at https://lore.kernel.org/all/20260722085819.495211F000E9@smtp.kernel.org/ the timeout values are incorrectly computed in driver, resulting wrong heartbeat. This leads to devere problems if watchdog was enabled at probe time. According to the data-sheet, the "too fast" ping limit is configured as multiple of FASTNG_MIN. Furthermore, the "too slow" ping limit is configured as multiples of "too fast" timeout. The FASTNG_MIN is set to 11, meaning 1.1 mS and "too fast" and "too slow" limits are computed from this. Hence, converting the limits to mS should be done by dividing by 10, not by dividing by USEC_PER_MSEC. Fix this by dividing the timeout values with correct scaling factor. While at it, fix whitespace problem (double empty line). Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Fixes: 09dad69757b6 ("watchdog: ROHM BD96801 PMIC WDG driver") Link: https://lore.kernel.org/r/amxskHmQbi9v-8_l@mva-rohm [groeck: Added reference to whitespace change to description] Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-07-31drm/msm: detach the ARM DMA mapping before attaching our own domainDmitry Baryshkov
On ARM32 with CONFIG_ARM_DMA_USE_IOMMU, arch_setup_dma_ops() creates a dma_iommu_mapping for every IOMMU-backed device and attaches its domain to the device's IOMMU group. That domain is neither the group's default nor its blocking domain, so when msm_iommu_new() later attaches the domain the driver manages itself, __iommu_attach_group() refuses it: if (group->domain && group->domain != group->default_domain && group->domain != group->blocking_domain) return -EBUSY; Both the GPU and the display controller are hit by this on apq8064 (IFC6410), leaving the board with no GPU and no display: adreno 4300000.gpu: failed to load adreno gpu adreno 4300000.gpu: probe with driver adreno failed with error -16 mdp4 5100000.display-controller: [drm:msm_drm_kms_init] *ERROR* failed to load kms mdp4 5100000.display-controller: adev bind failed: -16 Other ARM32 DRM drivers that manage their own domains (tegra, rockchip, exynos) drop the arch mapping first. Do the same in msm_iommu_new(), which both the display and the GPU paths go through. With this the GPU and the KMS device both initialise: [drm] Initialized msm 1.13.0 for 4300000.gpu on minor 0 [drm] Initialized msm-kms 1.13.0 for 5100000.display-controller on minor 1 Assisted-by: Claude:claude-opus-5 Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/743333/ Link: https://lore.kernel.org/r/20260730-fix-qcom-smmu-v2-3-18e0daf2d836@oss.qualcomm.com
2026-07-31drm/msm/dsi: Drop dev_pm_opp_set_rate(0)Konrad Dybcio
dev_pm_opp_set_rate(0) removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. Drop the explicit call to it. Every call site of ops->link_clk_disable() is followed by pm_runtime_put(), so the power vote will be rescinded if deemed safe. Fixes: 32d3e0feccfe ("drm/msm: dsi: Use OPP API to set clk/perf state") Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/742783/ Link: https://lore.kernel.org/r/20260728-topic-dpu_power-v1-3-e7783b859a70@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-07-31drm/msm/dp: Drop dev_pm_opp_set_rate(0)Konrad Dybcio
dev_pm_opp_set_rate(0) removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. Drop the explicit calls to it. Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/742781/ Link: https://lore.kernel.org/r/20260728-topic-dpu_power-v1-2-e7783b859a70@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-07-31drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)Konrad Dybcio
dev_pm_opp_set_rate(0) removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. Prevent that from happening when _dpu_core_perf_get_core_clk_rate() returns 0. Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/742779/ Link: https://lore.kernel.org/r/20260728-topic-dpu_power-v1-1-e7783b859a70@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-07-31drm/msm/dp: pass panel to display enable/disable helpersYongxing Mou
Pass struct msm_dp_panel to the display enable/disable helpers to make them easier to reuse for MST stream handling. Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/742752/ Link: https://lore.kernel.org/r/20260728-dp_mstclean-v9-14-f7779fce10f4@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-07-31drm/msm/dp: make bridge helpers use dp_display to allow re-useAbhinav Kumar
dp_bridge helpers take drm_bridge as an input and extract the dp_display object to be used in the dp_display module. Rather than doing it in a roundabout way, directly pass the dp_display object to these helpers so that the MST bridge can also re-use the same helpers. Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com> Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/742750/ Link: https://lore.kernel.org/r/20260728-dp_mstclean-v9-13-f7779fce10f4@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-07-31drm/msm/dp: simplify link and clock disable sequenceYongxing Mou
Move the common disable steps out of the sink_count check to make the flow easier to follow. No functional change intended. Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/742749/ Link: https://lore.kernel.org/r/20260728-dp_mstclean-v9-12-f7779fce10f4@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-07-31drm/msm/dp: split dp_ctrl_off() into stream and link partsAbhinav Kumar
Split dp_ctrl_off() into stream and link parts so that for MST cases we can control the link and pixel parts separately. Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com> Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/742746/ Link: https://lore.kernel.org/r/20260728-dp_mstclean-v9-11-f7779fce10f4@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-07-31drm/msm/dp: allow dp_ctrl stream APIs to use any panel passed to itAbhinav Kumar
With MST, multiple sinks share a single DP controller, so a cached panel in msm_dp_ctrl_private can no longer represent the per-stream sink. Drop the cache and pass panel explicitly to all stream-related dp_ctrl APIs. Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com> Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/742745/ Link: https://lore.kernel.org/r/20260728-dp_mstclean-v9-10-f7779fce10f4@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-07-31drm/msm/dp: re-arrange dp_display_disable() into functional partsAbhinav Kumar
dp_display_disable() handles special case of when monitor is disconnected from the dongle while the dongle stays connected thereby needing a separate function dp_ctrl_off_link_stream() for this. However with a slight rework this can still be handled by keeping common paths same for regular and special case. Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com> Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/742742/ Link: https://lore.kernel.org/r/20260728-dp_mstclean-v9-9-f7779fce10f4@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-07-31drm/msm/dp: break up dp_display_enable into two partsAbhinav Kumar
dp_display_enable() currently re-trains the link if needed and then enables the pixel clock, programs the controller to start sending the pixel stream. Split these two parts into prepare/enable APIs, to support MST bridges_enable insert the MST payloads funcs between enable stream_clks and program register. Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com> Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/742740/ Link: https://lore.kernel.org/r/20260728-dp_mstclean-v9-8-f7779fce10f4@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-07-31drm/msm/dp: move the pixel clock control to its own APIYongxing Mou
Enable/Disable of DP pixel clock happens in multiple code paths leading to code duplication. Move it into individual helpers so that the helpers can be called wherever necessary. Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com> Signed-off-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/742738/ Link: https://lore.kernel.org/r/20260728-dp_mstclean-v9-7-f7779fce10f4@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>