| Age | Commit message (Collapse) | Author |
|---|
|
It's more reasonable to tear down the rs64mem bitmap software
context at MES sw_fini phase. This also can avoid the following
lock order issue.
[ 2529.150983] kworker/u64:1/3134 is trying to acquire lock:
[ 2529.151206] ffff8aebd9a3fa10 (reservation_ww_class_mutex){+.+.}-{4:4}, at: amdgpu_bo_free_kernel+0x4e/0x130 [amdgpu]
[ 2529.151989]
but task is already holding lock:
[ 2529.152227] ffff8aebd2411648 (&reset_domain->sem){++++}-{4:4}, at: amdgpu_device_lock_reset_domain+0x20/0x30 [amdgpu]
[ 2529.153008]
which lock already depends on the new lock.
[ 2529.153342]
the existing dependency chain (in reverse order) is:
[ 2529.153645]
-> #2 (&reset_domain->sem){++++}-{4:4}:
[ 2529.153913] down_read+0x4a/0x240
[ 2529.154081] amdgpu_userq_destroy+0xd8/0x3a0 [amdgpu]
[ 2529.154635] amdgpu_userq_ioctl+0x3e2/0xe30 [amdgpu]
[ 2529.155157] drm_ioctl_kernel+0xaf/0x110 [drm]
[ 2529.155401] drm_ioctl+0x290/0x510 [drm]
[ 2529.155612] amdgpu_drm_ioctl+0x52/0x90 [amdgpu]
[ 2529.156068] __x64_sys_ioctl+0xa0/0xf0
[ 2529.156249] x64_sys_call+0x1278/0x21c0
[ 2529.156434] do_syscall_64+0xbe/0x5f0
[ 2529.156611] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 2529.156842]
-> #1 (&userq_mgr->userq_mutex){+.+.}-{4:4}:
[ 2529.157127] __mutex_lock+0xb2/0x11a0
[ 2529.157304] mutex_lock_nested+0x1f/0x30
[ 2529.157492] amdgpu_userq_vm_validate_and_restore_queue+0x710/0x9b0 [amdgpu]
[ 2529.158098] amdgpu_userq_restore_worker+0x39/0x290 [amdgpu]
[ 2529.158646] process_one_work+0x23e/0x6f
-> #0 (reservation_ww_class_mutex){+.+.}-{4:4}:
[ 2529.159832] __lock_acquire+0x14c4/0x2210
[ 2529.160021] lock_acquire+0xc6/0x310
[ 2529.160193] __ww_mutex_lock.constprop.0+0xd9/0x1a30
[ 2529.160419] ww_mutex_lock+0x40/0xb0
[ 2529.160590] amdgpu_bo_free_kernel+0x4e/0x130 [amdgpu]
[ 2529.161077] amdgpu_mes_rs64mem_fini+0x35/0x60 [amdgpu]
[ 2529.161601] mes_v11_0_suspend+0x2d/0x40 [amdgpu]
[ 2529.162102] amdgpu_ip_block_suspend+0x2b/0x70 [amdgpu]
[ 2529.162609] amdgpu_device_ip_suspend_phase2+0xa4/0x270 [amdgpu]
[ 2529.163116] amdgpu_device_pre_asic_reset+0x130/0x1f0 [amdgpu]
[ 2529.163617] amdgpu_device_asic_reset+0x55/0x530 [amdgpu]
[ 2529.164101] amdgpu_device_gpu_recover+0x1e5/0x410 [amdgpu]
[ 2529.164592] amdgpu_userq_mgr_reset_work+0x80/0xa0 [amdgpu]
[ 2529.165140] amdgpu_userq_hang_detect_work+0xbb/0x1c0 [amdgpu]
[ 2529.165693] process_one_work+0x23e/0x6f0
[ 2529.165884] worker_thread+0x1c4/0x380
[ 2529.166065] kthread+0x10c/0x150
[ 2529.166226] ret_from_fork+0x314/0x390
[ 2529.166408] ret_from_fork_asm+0x1a/0x30
[ 2529.166595]
other info that might help us debug this:
[ 2529.166917] Chain exists of:
reservation_ww_class_mutex --> &userq_mgr->userq_mutex --> &reset_domain->sem
Signed-off-by: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Michael Chen <michael.chen@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
- Unify amdgpu_mes_alloc/free_proc|gang_ctx_index to provide
centralized RS64mem bitmap management for both KGD and KFD.
- Retrieve the bitmap bit for userq contex index based on a
per process granularity.
Signed-off-by: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Michael Chen <michael.chen@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
On gfx12, when more queues are ready than there are HQD slots
(oversubscription), MES keeps queues unmapped and maps a queue to an HQD
on demand when its doorbell rings; a queue is only refetched once its
per-queue work_done is cleared.
Historically oversubscription was handled via the aggregated doorbell,
but that is a shared level-wide signal: MES cannot tell which queue rang
and never clears a queue's work_done, so it relies on the coarse
oversubscription timer to rescan. gfx12 therefore drives GFX/compute
through the per-queue unmapped-doorbell path instead (the aggregated
doorbell now only serves SDMA), which can pinpoint the ringing queue and
lets MES stay idle otherwise.
But with unmapped-doorbell mode 1 (basic) a ring only sets a coarse
level-wide ready flag and does not read the per-queue bitmap or clear the
ringing queue's work_done. A queue still marked done from a prior dispatch
is skipped and its new work is never fetched: the completion never
signals, while queue creation succeeds and no dmesg error is reported.
Switch to mode 2 (basic+): MES reads the per-queue CP_UNMAPPED_QUEUE
bitmap, identifies which queue rang, and clears its work_done so it is
rescheduled promptly. This affects every queue MES schedules on gfx12
(KFD and DRM user queues), which share the one MES instance and this
global setting.
Tested on gfx1201: concurrent multi-queue dispatch that intermittently
stalled under mode 1 now passes on both the KFD and DRM userq paths.
v2: update commit message: describe the oversubscription case, why the
aggregated doorbell is not used for GFX/compute on gfx12, and why
basic+ (not basic) is required.
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Shaoyun Liu <shaoyun.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
So we can reuse these functions across different ASICs.
In order to simplify code, rename some functions as well.
Signed-off-by: Tao Zhou <tao.zhou1@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
This version brings along the following updates:
- Add KUnit tests for crtc functions.
- Add KUnit tests for crtc functions.
- Add support for dynamic FFE levels.
- Configure all CRC engines in pipe CRC source path.
- Enable DCN6 compilation.
- Fix ABM over VABC.
- Fix CRC engine 1 enable/disable on DCN3.1.2+.
- Fix MCM blend LUT issues.
- Fix seamless mode switch not triggering for HDR to SDR transition.
- Fix wb_info leak and NULL deref in writeback.
- Increase fclk change latency on dcn351.
- Refactor stream validation.
- Resize MST HDCP per-connector arrays to 32.
- Unify force_yuv debugfs into force_yuv_pixel_format.
- Update VRR info packet to support 12-bit refresh rates.
Signed-off-by: Taimur Hassan <Syed.Hassan@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Reviewed-by: Alex Hung <alex.hung@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
Combine two related color manager improvements:
1. Migrate MCM/RMCM, shaper and 3DLUT HW programming to dc_plane_cm
- Continue convergence with upstream Color Manager refactor
- Migrate MCM/RMCM, shaper and 3DLUT programming for dcn401+ to dc_plane_cm
- Unify MCM programming across both legacy and 3DLUT DMA paths
- Add 3DLUT DMA broadcast support for multi-pipe planes
2. Reprogram MCM blend LUT on blend_enable falling edge
- Fix issue where SDR desktop remained desaturated after video playback
- Detect blend_enable falling edge (1->0) in surface update detection
- Force MCM LUT reprogramming on blend state change
Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Rafal Ostrowski <rafal.ostrowski@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
[How & Why]
Follow-up change to set defaults for HDMI FRL training
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Relja Vojvodic <Relja.Vojvodic@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
[How & Why]
- Add support for dynamic FFE levels based on debug config and link rate
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Relja Vojvodic <Relja.Vojvodic@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
[Description]
DCN6 needs to update BW bounding box in hw init in order to propagate
the Alt-Ch aperture info into DML. In this case update unconditionally
on dcn6 HW init.
Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
drmm_connector_init() and drmm_encoder_init() register their cleanup
(drm_connector_cleanup() / drm_encoder_cleanup()) as DRM-managed actions
tied to the drm_device lifetime. When the object memory is owned by
KUnit, it is freed before that action runs, so the cleanup touches freed
memory. Allocate these objects with drmm_kzalloc() so their lifetime
matches the cleanup action.
Signed-off-by: Alex Hung <alex.hung@amd.com>
Assisted-by: Copilot:Claude-Opus-4.8
Acked-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
Iterate every CRC engine instance when enabling or disabling the pipe CRC
source so DCN31x OTG_CRC1_EN is handled alongside OTG_CRC_EN, matching the
legacy shared enable behavior used by DisplayCRC multi-ROI.
Reviewed-by: ChiaHsuan (Tom) Chung <chiahsuan.chung@amd.com>
Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
[Why]
Multi-ROI CRC uses OTG_CRC1_EN for the second engine, but the driver
only toggled OTG_CRC_EN and cleared the whole OTG_CRC_CNTL register on
disable.
[How]
Program engine 1 via OTG_CRC1_EN where supported, disable each
engine independently by crc_eng_inst, and add the missing mask on
relevant DCN ASICs.
Reviewed-by: ChiaHsuan (Tom) Chung <chiahsuan.chung@amd.com>
Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
[Why]
Configuring CRC engine 1 via optc35_configure_crc() triggers
ASSERT(mask != 0) in dc_helper.c when programming OTG_CRC1_SELECT.
The DCN3.2 OPTC mask list inherited from dcn32 is missing this field,
so ROI[1] CRC cannot be enabled in DisplayCRC mode on DCN3.5/3.51.
[How]
Add OTG_CRC1_SELECT to OPTC_COMMON_MASK_SH_LIST_DCN3_2, matching the
existing dcn10 definition so REG_UPDATE can program CRC engine 1.
Reviewed-by: ChiaHsuan (Tom) Chung <chiahsuan.chung@amd.com>
Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
[Why]
Should have been picked up in 0.1.69.0 promotion commit.
[How]
Add the missing DMUB command-header definitions in dmub_cmd.h:
1. DMUB_CMD__CACP_GET_ACE_CURVE_AREA command ID.
2. Request/response data and command structs.
3. PR runtime flag bit.
Signed-off-by: Taimur Hassan <Syed.Hassan@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Reviewed-by: Alex Hung <alex.hung@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
[why]
These registers are used, but were missing from their corresponding lists.
Reviewed-by: Ovidiu (Ovi) Bunea <ovidiu.bunea@amd.com>
Signed-off-by: Matthew Stewart <Matthew.Stewart2@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
[Why]
ABM does not take effect when brightness
is below twenty percent on VABC LCD panels.
[How]
Create new VESA aux path for brightness
translation functions. When VESA aux enabled
use zero-anchored linear interpolation to
translate instead of the legacy min max
backlight mapping.
Reviewed-by: Anthony Koo <anthony.koo@amd.com>
Signed-off-by: Iswara Nagulendran <Iswara.Nagulendran@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
Add dm_test_crtc_destroy_state_releases_stream to cover the cur->stream
branch of amdgpu_dm_crtc_destroy_state(), complementing the existing
no-stream test.
The test attaches a DC stream to the CRTC state and takes an extra stream
reference so the destroy path drops back to the KUnit-managed reference
instead of freeing the stream, then verifies exactly one reference was
released.
Assisted-by: Copilot:Claude-Opus-4.8
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
Add dm_test_crtc_enable_vblank_ips_restore_replay to cover the
pr->config.replay_supported side of the sr_supported OR in
amdgpu_dm_crtc_set_vblank().
The existing IPS restore test establishes self-refresh support via the PSR
version. This test instead marks the PSR version unsupported and sets
replay_supported, forcing the sr_supported computation to fall through to
the replay branch while still calling drm_crtc_vblank_restore().
Assisted-by: Copilot:Claude-Opus-4.8
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
Add dm_test_crtc_enable_vblank_ips_restore to cover the IPS/self-refresh
branch of amdgpu_dm_crtc_set_vblank() that calls drm_crtc_vblank_restore().
The test primes the DC with ips_support set and IPS not fully disabled, a
supported PSR version (self-refresh supported) and an immediate-disable
vblank config, so all four conditions gating the restore hold. A stub
get_vblank_timestamp hook is installed on the CRTC so the restore helper
passes its sanity check, and the enable path then runs to completion.
Assisted-by: Copilot:Claude-Opus-4.8
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
Add dm_test_crtc_enable_vblank_queues_work and
dm_test_crtc_disable_vblank_queues_work to cover the
vblank_control_workqueue branch of amdgpu_dm_crtc_set_vblank():
- The enable test installs a real workqueue, retains the stream and
queues the control worker, then drains it and checks the active vblank
IRQ count was incremented.
- The disable test drives the no-stream sub-branch (the stream-retain is
skipped) and checks the worker decremented the count.
Both seed the ISM so the queued worker takes no state-machine transition,
keeping coverage on the vblank accounting; the ISM state machine itself
is covered by the ISM tests.
Assisted-by: Copilot:Claude-Opus-4.8
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
Add coverage for the amdgpu_dm_crtc_set_vblank() paths reached through
amdgpu_dm_crtc_enable_vblank() and amdgpu_dm_crtc_disable_vblank():
- dm_test_crtc_enable_vblank_full_path: VRR-active enable that walks the
vupdate-irq branch and acquires the crtc/pageflip IRQ references.
- dm_test_crtc_enable_vblank_vupdate_busy: vupdate IRQ rejection aborts
the enable with -EBUSY.
- dm_test_crtc_enable_vblank_crtc_irq_error: crtc IRQ acquire failure
aborts the enable with -ENOENT.
- dm_test_crtc_enable_vblank_in_reset: an in-progress GPU reset returns
early before the vblank workqueue branch.
- dm_test_crtc_disable_vblank_vrr: the VRR disable path turns the vupdate
IRQ off and releases both IRQ references.
Add shared IRQ-source stubs and setup helpers so amdgpu_irq_get()/put()
succeed without hardware access.
Assisted-by: Copilot:Claude-Opus-4.8
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
[Why]
fclk change latency is longer than expected on dcn351.
[How]
Increate fclk change latency from 24us to 32us.
Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Sung-huai Wang <Danny.Wang@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
[Why]
The connector exposed a single force_yuv420_output boolean debugfs and
carried force_yuv420_output / force_yuv422_output boolean fields to force a
chroma encoding. This cannot express "force RGB" or "force YCbCr444", and
diverges from the upstream amdgpu_dm which uses a single
force_yuv_pixel_format field keyed on enum dc_pixel_encoding.
[How]
- Replace the two boolean fields with a single uint8_t
force_yuv_pixel_format holding an enum dc_pixel_encoding value
(PIXEL_ENCODING_UNDEFINED == no override).
- Replace the force_yuv420_output boolean debugfs with a read/write
force_yuv_pixel_format file that takes the encoding directly
(1=RGB, 2=YCbCr422, 3=YCbCr444, 4=YCbCr420), validated against
PIXEL_ENCODING_COUNT.
- Convert the existing readers/writers in amdgpu_dm_connector.c to the
new field, preserving current behaviour.
- Add YCbCr444 force support now that the field can express it.
v2: Merge with changed from drm-misc (Alex)
Assisted-by: Copilot:claude-opus-4.8
Reviewed-by: Jerry Zuo <jerry.zuo@amd.com>
Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
Commit 94104e3cfa80 ("arm64: cpufeature: Rename BBML2_NOABORT as BBML3")
renamed the cpu_supports_bbml2_noabort() helper to cpu_supports_bbml3(),
as the Linux-defined "noabort" semantics have now been incorporated into
the architecture under the BBML3 feature.
Update the caller in the SMMUv3 SVA driver to use the new function.
There is a slightly oddity in that the SMMUv3 architecture already
defined BBML2 in such a way that aborts were prohibited, so we use the
BBML3 feature on the CPU to enable BBML2 in the SMMU.
Fixes: 94104e3cfa80 ("arm64: cpufeature: Rename BBML2_NOABORT as BBML3")
Signed-off-by: Will Deacon <will@kernel.org>
|
|
A ism interrupt handler can be active in parallel with ism_dev_exit(),
accessing freed data structures.
No new interrupts will be generated after unregister_ieq(). Drain ongoing
interrupt handlers by free_irq(), before freeing ism data structures.
Fixes: 684b89bc39ce ("s390/ism: add device driver for internal shared memory")
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Link: https://patch.msgid.link/20260805131043.954639-1-wintera@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
If bnge_init_chip() fails, bnge_init_nic() jumps to err_free_ring_grps
and returns immediately, skipping cleanup for RX ring pair buffers.
Remove the early return so execution falls through to
err_free_rx_ring_pair_bufs to properly free resources on error.
Fixes: 23df6aebf803 ("bng_en: Allocate stat contexts")
Signed-off-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com>
Reviewed-by: Dharmender Garg <dharmender.garg@broadcom.com>
Reviewed-by: Rajashekar Hudumula <rajashekar.hudumula@broadcom.com>
Link: https://patch.msgid.link/20260805094022.15487-1-bhargava.marreddy@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
force_close_task runs on the system workqueue, which destroy_workqueue()
does not drain, so it can run after free_netdev() and touch freed memory.
Cancel it after destroying the workqueues, before free_netdev().
This issue was found by an in-house static analysis tool.
Cc: stable+noautosel@kernel.org # untested fix to a driver init path race
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260805012337.416908-1-fanwu01@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
fjes_remove() destroys the driver workqueues before unregistering the
netdev. The interrupt handler queues work on them, but the IRQ is only
freed from fjes_close() under unregister_netdev(), so an interrupt in that
window can queue work once the workqueues are gone.
Unregister the netdev first so fjes_close() frees the IRQ and cancels the
workers before the workqueues are destroyed. force_close_task, which the
workers arm on the system workqueue, is handled in the next patch.
This issue was found by an in-house static analysis tool.
Cc: stable+noautosel@kernel.org # untested fix to a driver init path race
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260805011410.414431-1-fanwu01@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
fsl_samsung_hdmi_phy_probe() enables runtime PM, but the remove
callback does not disable it. Unbinding and rebinding the device
therefore results in the following warning on reprobe:
Unbalanced pm_runtime_enable!
Disable runtime PM after removing the clock provider.
Also undo the runtime PM operations when phy_clk_register() fails.
Otherwise, a failed probe leaves runtime PM enabled and the usage
counter incremented.
Signed-off-by: Fabio Estevam <festevam@nabladev.com>
Link: https://patch.msgid.link/20260729192830.487150-1-festevam@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
The EEPROM board ID is a fixed 13-byte field and is not guaranteed to
contain a NUL terminator. Passing it directly to
devlink_info_version_fixed_put() treats it as a C string and may read
beyond the field.
Format at most OCP_BOARD_ID_LEN bytes into the existing local buffer
before reporting the ID. Use a precision limit because the snprintf()
output size alone does not bound the source string scan.
Fixes: 0cfcdd1ebcfe ("ptp: ocp: add nvmem interface for accessing eeprom")
Cc: stable@vger.kernel.org
Signed-off-by: Ahmad Byagowi <ahmadexp@gmail.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Link: https://patch.msgid.link/20260804210751.48248-1-ahmadexp@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The silent pin of the CAN transceiver is active high, asserting it puts
the transceiver into silent (listen-only) mode where the transmitter is
disabled.
At probe time, and before the PHY is powered on, the transceiver should
default to silent mode. This is the correct and lower-power state: the
transceiver should not actively drive the CAN bus until the PHY is
explicitly powered on. Requesting the silent GPIO as GPIOD_OUT_LOW leaves
the transceiver in normal mode by default, which is both incorrect and
wastes power.
Request the silent GPIO as GPIOD_OUT_HIGH so the transceiver starts in
silent mode, and let the power_on/power_off callbacks manage the mode
afterwards.
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Reviewed-by: Marc Kleine-Budde <mkl@pengutronix.de>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260730-can-share-silent-v1-1-63fd603f943d@nxp.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
The TMDS character rate of this PHY is configured using PHY bus width
in downstream vendor kernel and out-of-tree patches, however no in-tree
consumer of this PHY has ever called phy_set_bus_width() to change the
TMDS character rate as currently only 8-bit RGB output is supported by
the HDMI display driver.
The series "Split Generic PHY consumer and provider" clarifies that
phy_set_bus_width() is intended as a provider-only function.
Remove the deprecated unused fallback way to configure TMDS character
rate now that this HDMI PHY support using phy_configure() to configure
the TMDS character rate.
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Tested-by: Heiko Stuebner <heiko@sntech.de> #rk3328
Tested-by: Diederik de Haas <diederik@cknow-tech.com> # Rock64
Link: https://patch.msgid.link/20260518180722.2480799-3-jonas@kwiboo.se
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
The commit 10ed34d6eaaf ("phy: Add HDMI configuration options")
introduced a way for HDMI PHYs to be configured through the generic
phy_configure() function.
This driver derives the TMDS character rate from the pixel clock and the
PHY bus width setting. However, no in-tree consumer of this PHY has ever
called phy_set_bus_width() to change the TMDS character rate as only
8-bit RGB output is supported by the HDMI display driver.
Add configure() and validate() ops to allow consumers to configure the
TMDS character rate using phy_configure(). Fallback to the deprecated
way of using the PHY bus width to configure the TMDS character rate.
A typical call chain during DRM modeset on a RK3328 device:
dw_hdmi_rockchip_encoder_atomic_check():
- inno_hdmi_phy_validate(): pixclock 148500000 tmdsclock 594000000
dw_hdmi_rockchip_encoder_atomic_mode_set():
- inno_hdmi_phy_configure(): pixclock 148500000
- inno_hdmi_phy_validate(): pixclock 148500000 tmdsclock 594000000
vop_crtc_atomic_enable():
- inno_hdmi_phy_rk3328_clk_set_rate(): rate 594000000 tmdsclk 594000000
inno_hdmi_phy_rk3328_clk_set_rate(): pixclock 594000000 tmdsclock 594000000
- inno_hdmi_phy_rk3328_clk_recalc_rate(): pixclock 594000000 vco 594000000
dw_hdmi_rockchip_encoder_enable():
- inno_hdmi_phy_power_on(): Inno HDMI PHY Power On
- inno_hdmi_phy_rk3328_clk_set_rate(): rate 594000000 tmdsclk 594000000
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Tested-by: Heiko Stuebner <heiko@sntech.de> #rk3328
Tested-by: Diederik de Haas <diederik@cknow-tech.com> # Rock64
Link: https://patch.msgid.link/20260518180722.2480799-2-jonas@kwiboo.se
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
At high data rates like 4K60 (2500 Mbps), such as when using an
LT6911GXD bridge chip on an RK3588 board, fixed default timing parameters
can cause signal integrity issues and clock-data recovery failures.
The driver currently lacks a mechanism to adjust the clock lane sampling
phase to compensate for board-specific trace variations.
Resolve this by parsing and applying the optional 'rockchip,clk-lane-phase'
device tree property. This enables board-specific tuning of the clock
lane sampling phase in ~40 ps steps (range 0-7) to optimize link
stability. If the property is absent, the driver falls back to the
hardware default.
Signed-off-by: Gerald Loacker <gerald.loacker@wolfvision.net>
Reviewed-by: Michael Riesch <michael.riesch@collabora.com>
Link: https://patch.msgid.link/20260725-feature-mipi-csi-dphy-4k60-v4-3-5b2c4626d31e@wolfvision.net
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
The rk1808 hsfreq table capped at 2499 Mbps, preventing a data rate of
exactly 2500 Mbps. Extend the final entry to 2500 Mbps to support this
rate.
This is essential for RK3588 reusing this array and fully supporting
rates up to 2500 Mbps.
Fixes: bd1f775d6027 ("phy/rockchip: add Innosilicon-based CSI dphy")
Reviewed-by: Michael Riesch <michael.riesch@collabora.com>
Signed-off-by: Gerald Loacker <gerald.loacker@wolfvision.net>
Link: https://patch.msgid.link/20260725-feature-mipi-csi-dphy-4k60-v4-1-5b2c4626d31e@wolfvision.net
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
Fix the error paths of sp_uphy_init() to undo exactly what each stage
did: return directly if clk_prepare_enable() fails, release only the clock
if reset_control_deassert() fails, and jump to err_reset if
update_disc_vol() fails so the clock and reset are not leaked.
Fixes: 99d9ccd97385 ("phy: usb: Add USB2.0 phy driver for Sunplus SP7021")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Link: https://patch.msgid.link/20260803-sunplus-usb3-v1-1-5a562524c869@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
for_each_child_of_node_scoped() releases the node reference on scope
exit, so the explicit of_node_put(np) in the devm_phy_create() error
path drops it twice.
Drop the redundant of_node_put() and let the scoped cleanup handle it.
Fixes: b64b32791fb5 ("phy: renesas: rcar-gen2: Simplify with scoped for each OF child loop")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260803-rcar-gen2-v1-1-9aa35c36d7d7@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
[Why]
amdgpu_dm_create_validate_stream_for_sink() drove its RGB -> YUV422 ->
YUV420 chroma fallback by recursing and toggling the shared
aconnector->force_yuv420_output / force_yuv422_output fields, resetting
them after each recursive call. Those fields have no locking and the
function runs concurrently on the same connector from two paths: the
connector probe worker (->mode_valid) and a compositor's atomic check
(dm_update_crtc_state). When both run at once, one thread can clear the
override just before the other tests its exit condition, so the exit is
missed and validation loops indefinitely, hanging the modeset path.
[How]
- Replace the recursion with an explicit loop over the chroma encodings
wrapping the existing bpc walk.
- Carry the encoding/bpc selection on the stack, passed by value into
create_stream_for_sink() / fill_stream_properties_from_drm_display_mode(),
instead of mutating shared connector state.
- Derive the supported encodings and bit depths into bitmaps and drive
validation from them, gating each candidate on the sink's advertised
capability so unsupported encodings are never retried.
- Move encoding selection entirely to the caller and pass the chosen
dc_pixel_encoding into fill_stream_properties_from_drm_display_mode().
v2: sqaush in KUnit test fixes, merge with drm-misc changes (Alex)
Assisted-by: Copilot:claude-opus-4.8
Reviewed-by: Jerry Zuo <jerry.zuo@amd.com>
Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b
("PCI: Change all drivers to use pci_device->revision") replaced a
configuration-space read with direct access to the cached revision field,
but left that access after pci_dev_put(). The bridge may therefore be freed
before its revision is read.
Read the revision before dropping the reference.
Fixes: 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision")
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
|
|
On i.MX8MP, the USB PHY has a dedicated power domain that was previously
never powered off at runtime. With the introduction of runtime PM support,
the power domain will be powered off if the device is runtime suspended,
which breaks USB wakeup functionality.
To preserve wakeup functionality, mark the PHY power domain as runtime
always-on for i.MX8MP platform. To limit the behavior to i.MX8MP, add a
need_genpd_rpm_on to imx8mq_usb_phy_drvdata and set it as true for i.MX8MP.
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260731-imx8mp-usb-phy-improvement-v8-6-2ec8d6b3854d@nxp.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
Replace direct use of phy_ops pointer in of_device_id .data with a
dedicated imx8mq_usb_phy_drvdata structure. This allows per-variant
driver data to be extended in the future without changing the match
table.
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Link: https://patch.msgid.link/20260731-imx8mp-usb-phy-improvement-v8-5-2ec8d6b3854d@nxp.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
The CR port is a simple 16-bit data/address parallel port that is
accessed through 32-bit MMIO registers for on-chip access to the
control registers inside the USB 3.0 femtoPHY. Add control register
regmap and export these registers by debugfs to help PHY's diagnostic.
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Link: https://patch.msgid.link/20260731-imx8mp-usb-phy-improvement-v8-4-2ec8d6b3854d@nxp.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
Add runtime PM support to ensure the PHY clocks are properly gated
when the PHY is not in use, reducing power consumption.
Clock management is moved from power_on()/power_off() callbacks into
the runtime_resume()/runtime_suspend() callbacks respectively. The PHY
subsystem core already holds a runtime PM reference around init() and
power_on/off() calls, so no explicit clock handling is needed there.
Use devm_clk_get_enabled() and devm_clk_get_optional_enabled() in
probe() to keep clocks enabled initially. This ensures the PHY remains
functional when CONFIG_PM is disabled, where runtime suspend/resume
callbacks are never invoked.
In tca_blk_typec_switch_set(), replace the manual clk_prepare_enable()
/ clk_disable_unprepare() pair with PM_RUNTIME_ACQUIRE_IF_ENABLED() to
guard register access against a concurrently suspended PHY.
Move devm_regulator_get() before pm_runtime_enable() to avoid having
to clean up runtime PM state on regulator acquisition failure.
In remove(), call pm_runtime_get_sync() before pm_runtime_disable() to
ensure the PHY is resumed and clocks are enabled before the devres
teardown disables them.
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260731-imx8mp-usb-phy-improvement-v8-3-2ec8d6b3854d@nxp.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
Set PHY wakeup capable because this PHY supports remote wakeup function.
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Link: https://patch.msgid.link/20260731-imx8mp-usb-phy-improvement-v8-2-2ec8d6b3854d@nxp.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
If probe fails after imx95_usb_phy_get_tca() succeeds, the typec
switch leaks because the only cleanup path was in .remove(), which
never runs on probe failure.
Use devm_add_action_or_reset() so the switch is cleaned up on both
probe failure and driver removal. The imx95_usb_phy_put_tca() is no
longer needed, it will be removed in .remove() too.
Fixes: b58f0f86fd61 ("phy: fsl-imx8mq-usb: add tca function driver for imx95")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Xu Yang <xu.yang_2@nxp.com>
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Link: https://patch.msgid.link/20260731-imx8mp-usb-phy-improvement-v8-1-2ec8d6b3854d@nxp.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
Has been tested with the following capabilities:
- USB Type-C at 10Gb/s
- DP Alt Mode, using HBR2
- USB Type-C at 480Mb/s + DP Alt Mode, using HBR2
RX and PCS USB tables had to be added, while serdes, TX and PCS tables were
reused from other SoCs.
Some SoCs such as SAR2130P, SM7550, SM7635 and SM8475 use 4nm-v1 PLLs.
For SM8475, trying to use qmp_v6_dp_serdes_tbl structs (which are for
4nm-v1.1 PLLs) causes link training to fail because of ref clock
differences, which in turn makes these structs differ.
Add structs for v1 PLLs as well.
Signed-off-by: Esteban Urrutia <esteuwu@proton.me>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://patch.msgid.link/20260804-sm8475-bup-usbss-v3-2-9a5b9ebf62de@proton.me
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
VBUS regulator
devm_regulator_get_exclusive() initialises the regulator with
enable_count = 1, requiring the consumer to disable it before release.
The devm disable action was previously only registered when the caller
explicitly requested enable, so when the regulator was left in its initial
enabled state without an explicit enable call, the cleanup path skipped
decrementing enable_count, triggering a WARN_ON during regulator
release on device removal.
Fix this by always registering the devm disable action based on the actual
enabled state via regulator_is_enabled(), regardless of whether the
caller requested an explicit enable. This covers both the explicitly
enabled case and the initial state set by devm_regulator_get_exclusive().
Fixes: 24843404efe4 ("phy: renesas: phy-rcar-gen3-usb2: Control VBUS for RZ/G2L SoCs")
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://patch.msgid.link/20260806102236.149159-9-biju.das.jz@bp.renesas.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
Add renesas,usb2-phy-r9a08g046 to the OF match table, reusing
rz_g3s_phy_usb2_data as the PHY configuration is shared with RZ/G3S.
While the PHY data is shared, RZ/G3L differs from RZ/G3S in that it has
two OTG controllers, OTG interrupts on port 2, and a controllable
OTG_PERI bit in COMMCTRL for host/device switching on the port 2 USB
controller, which is fixed to host-only on RZ/G3S.
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://patch.msgid.link/20260806102236.149159-8-biju.das.jz@bp.renesas.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
Add support for the USB3-DP combo PHY found on Hawi platform.
The QMP PHY for Hawi uses QSERDES V10 register layouts. Add the required
PHY sequences from the hardware programming guide and new V10 register
header files. Also add a new v10 offset structure to incorporate the new
COM AON register module.
Signed-off-by: Ronak Raheja <ronak.raheja@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Link: https://patch.msgid.link/20260803091441.3040830-5-mukesh.ojha@oss.qualcomm.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
In cxacru_unbind(), cancel_delayed_work_sync() was conditionally skipped
when poll_state was CXPOLL_STOPPED. However, a work item previously
scheduled when poll_state was CXPOLL_POLLING may still be pending in the
workqueue at the time poll_state transitions to CXPOLL_STOPPED. Skipping
cancel_delayed_work_sync() in this case allows the work to fire after
cxacru_data is freed, causing a use-after-free when cxacru_poll_status()
attempts to acquire instance->poll_state_serialize.
Fix this by always calling cancel_delayed_work_sync() regardless of
poll_state, ensuring no pending or in-flight work can access the freed
instance.
Cc: stable+noautosel@kernel.org # untested fix to a driver init path race
Reported-by: syzbot+24eb38c789655fc43663@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=24eb38c789655fc43663
Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
Link: https://patch.msgid.link/20260803101716.2592486-1-khiemtranzo532001@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
