summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-12-16drm/amd/include : Update MES v12 API headerShaoyun Liu
Add LDS out of range reporting support in mes API Signed-off-by: Shaoyun Liu <shaoyun.liu@amd.com> Reviewed-by: Jonathan Kim <jonathan.kim@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-12-16drm/amdgpu: flush tlb properly for GMC v12.1 in early phaseLe Ma
Flush tlb properly for GMC v12.1 Signed-off-by: Le Ma <le.ma@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-12-16drm/amdgpu: Use AMDGPU_IS_GFXHUB to screen out GFXHUB for GMC v12.1Le Ma
There're multiple gfxhubs on GMC v12.1 Signed-off-by: Le Ma <le.ma@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-12-16drm/amdgpu: only copy ucode for enabled xccLikun Gao
Only copy ucode for enabled xcc instead of copy for all 8 xcc for rlc autoload on gfx v12_1 to save time. Signed-off-by: Likun Gao <Likun.Gao@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-12-16drm/amdgpu: fix issue when switch NPS1 to NPSXchong li
fix the function execution sequence after removing kgd2kfd_init_zone_device out of gpu full access region. Fixes: c71980a3fc1d ("drm/amdgpu: reduce the full gpu access time in amdgpu_device_init.") Signed-off-by: chong li <chongli2@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-12-16drm/amd/display: Fix 64-bit state pointer passed as 32-bit GPINT response bufferSrinivasan Shanmugam
edp_pr_get_state() incorrectly casts a uint64_t * to uint32_t * when calling dc_wake_and_execute_gpint(). The GPINT path writes only 32 bits, leaving the upper 32 bits of the u64 output uninitialized. Replace the cast with a u32 temporary and copy the result into the u64 pointer. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_panel_control.c 1448 bool edp_pr_get_state(const struct dc_link *link, uint64_t *state) ^^^^^^^^^^^^^^^ 1449 { ... 1457 do { 1458 // Send gpint command and wait for ack --> 1459 if (!dc_wake_and_execute_gpint(dc->ctx, DMUB_GPINT__GET_REPLAY_STATE, panel_inst, 1460 (uint32_t *)state, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)) { ^^^^^^^^^^^^^^^^^ The dc_wake_and_execute_gpint() function doesn't take a u64, it takes a u32. It tries to initialize the state to zero at the start but that's not going to work because of the type mismatch. It suggests that callers are allowed to pass uninitialized data to edp_pr_get_state() but at present there are no callers so this is only a bug in the code but doesn't affect runtime. 1461 // Return invalid state when GPINT times out 1462 *state = PR_STATE_INVALID; 1463 } Fixes: 74ce00932e7e ("drm/amd/display: Refactor panel replay set dmub cmd flow") Reported by: Dan Carpenter <dan.carpenter@linaro.org> Cc: Robin Chen <robin.chen@amd.com> Cc: Jack Chang <jack.chang@amd.com> Cc: Leon Huang <Leon.Huang1@amd.com> Cc: Alex Hung <alex.hung@amd.com> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> Cc: Roman Li <roman.li@amd.com> Cc: Harry Wentland <harry.wentland@amd.com> Cc: Tom Chung <chiahsuan.chung@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-12-16drm/amd/include : Update MES v12 comments on RESET APIShaoyun Liu
Added comments for the layout of contents that addressed by doorbell_offset_addr in RESET API Signed-off-by: Shaoyun Liu <shaoyun.liu@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-12-16irqchip/riscv-aplic: Preserve APLIC states across suspend/resumeNick Hu
The APLIC states might be reset when the platform enters a low power state, but the register states are not being preserved and restored, which prevents interrupt delivery after the platform resumes. Solve this by adding a syscore ops and a power management notifier to preserve and restore the APLIC states on suspend and resume. [ tglx: Folded the build fix provided by Geert ] Signed-off-by: Nick Hu <nick.hu@sifive.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Yong-Xuan Wang <yongxuan.wang@sifive.com> Reviewed-by: Cyan Yang <cyan.yang@sifive.com> Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://patch.msgid.link/20251202-preserve-aplic-imsic-v3-2-1844fbf1fe92@sifive.com
2025-12-16wifi: iwlwifi: Implement settime64 as stub for MVM/MLD PTPYao Zi
Since commit dfb073d32cac ("ptp: Return -EINVAL on ptp_clock_register if required ops are NULL"), PTP clock registered through ptp_clock_register is required to have ptp_clock_info.settime64 set, however, neither MVM nor MLD's PTP clock implementation sets it, resulting in warnings when the interface starts up, like WARNING: drivers/ptp/ptp_clock.c:325 at ptp_clock_register+0x2c8/0x6b8, CPU#1: wpa_supplicant/469 CPU: 1 UID: 0 PID: 469 Comm: wpa_supplicant Not tainted 6.18.0+ #101 PREEMPT(full) ra: ffff800002732cd4 iwl_mvm_ptp_init+0x114/0x188 [iwlmvm] ERA: 9000000002fdc468 ptp_clock_register+0x2c8/0x6b8 iwlwifi 0000:01:00.0: Failed to register PHC clock (-22) I don't find an appropriate firmware interface to implement settime64() for iwlwifi MLD/MVM, thus instead create a stub that returns -EOPTNOTSUPP only, suppressing the warning and allowing the PTP clock to be registered. Reported-by: Nathan Chancellor <nathan@kernel.org> Closes: https://lore.kernel.org/all/20251108044822.GA3262936@ax162/ Signed-off-by: Yao Zi <ziyao@disroot.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> tested-by: damian Tometzki damian@riscv-rocks.de Tested-by: Oliver Hartkopp <socketcan@hartkopp.net> Acked-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20251204123204.9316-1-ziyao@disroot.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-12-16wifi: iwlwifi: Fix firmware version handlingVille Syrjälä
On my system the arithmetic done on the firmware numbers results in a negative number, but since the types are unsigned it gets interpreted as a large positive number. The end result is that the firmware gets rejected and wifi is defunct. Switch to signed types to handle this case correctly. iwlwifi 0000:0c:00.0: Driver unable to support your firmware API. Driver supports FW core 4294967294..2, firmware is 2. iwlwifi 0000:0c:00.0: Direct firmware load for iwlwifi-5000-4.ucode failed with error -2 iwlwifi 0000:0c:00.0: Direct firmware load for iwlwifi-5000-3.ucode failed with error -2 iwlwifi 0000:0c:00.0: Direct firmware load for iwlwifi-5000-2.ucode failed with error -2 iwlwifi 0000:0c:00.0: Direct firmware load for iwlwifi-5000-1.ucode failed with error -2 iwlwifi 0000:0c:00.0: no suitable firmware found! iwlwifi 0000:0c:00.0: minimum version required: iwlwifi-5000-1 iwlwifi 0000:0c:00.0: maximum version supported: iwlwifi-5000-5 iwlwifi 0000:0c:00.0: check git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git Cc: stable@vger.kernel.org Fixes: 5f708cccde9d ("wifi: iwlwifi: add a new FW file numbering scheme") Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220805 Link: https://patch.msgid.link/20251113222852.15896-1-ville.syrjala@linux.intel.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-12-16drm/i915/display: Allow async flip when Selective Fetch is enabledJouni Högander
Fix silent conflict during drm-next backmerge causing async flips being rejected when Selective Fetch is enabled. Fixes: b8304863a399 ("Merge drm/drm-next into drm-intel-next") Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20251216130351.2799110-1-jouni.hogander@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2025-12-16dmaengine: zynqmp_dma: Remove redundant pm_runtime_mark_last_busy() callsSakari Ailus
pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Abin Joseph <abin.joseph@amd.com> Link: https://patch.msgid.link/20251027133232.392898-6-sakari.ailus@linux.intel.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: ti: Remove redundant pm_runtime_mark_last_busy() callsSakari Ailus
pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Link: https://patch.msgid.link/20251027133232.392898-5-sakari.ailus@linux.intel.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: ste_dma40: Remove redundant pm_runtime_mark_last_busy() callsSakari Ailus
pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://patch.msgid.link/20251027133232.392898-4-sakari.ailus@linux.intel.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: pl330: Remove redundant pm_runtime_mark_last_busy() callsSakari Ailus
pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Link: https://patch.msgid.link/20251027133232.392898-2-sakari.ailus@linux.intel.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: at_xdmac: Remove redundant pm_runtime_mark_last_busy() callsSakari Ailus
pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Link: https://patch.msgid.link/20251027133232.392898-1-sakari.ailus@linux.intel.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()Biju Das
After audio full duplex testing, playing the recorded file contains a few playback frames from the previous time. The rz_dmac_terminate_all() does not reset all the hardware descriptors queued previously, leading to the wrong descriptor being picked up during the next DMA transfer. Fix the above issue by resetting all the descriptor headers for a channel in rz_dmac_terminate_all() as rz_dmac_lmdesc_recycle() points to the proper descriptor header filled by the rz_dmac_prepare_descs_for_slave_sg(). Cc: stable@kernel.org Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC") Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Link: https://patch.msgid.link/20251113195052.564338-1-biju.das.jz@bp.renesas.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: ti: k3-udma: enable compile testingJohan Hovold
There does not seem to be anything preventing the K3 UDMA drivers from being compile tested (on arm64 as one dependency depends on ARM64) so enable compile testing for wider build coverage. Note that the ring accelerator dependency can only be selected when "TI SOC drivers support" (SOC_TI) is enabled so select that option too. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251117161851.11242-1-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: stm32-dma3: introduce ddata2dev helperAmelie Delaunay
The purpose of this helper is to 'standardize' device pointer retrieval, similar to the chan2dev() helper. ddata2dev() helper returns the device pointer from struct dma_device stored in stm32_dma3_ddata structure. Device pointer from struct dma_device has been initialized with &pdev->dev, so the ddata2dev helper returns &pdev->dev. Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com> Link: https://patch.msgid.link/20251121-dma3_improv-v2-4-76a207b13ea6@foss.st.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: stm32-dma3: restore channel semaphore status after suspendAmelie Delaunay
Depending on the power state reached during suspend, the CxSEMCR register could have been reset, and the semaphore released. On resume, try to take the semaphore again. If the semaphore cannot be taken, an error log displaying the channel number and channel user is generated. This requires introducing two new functions: stm32_dma3_pm_suspend(), where the status of each channel is checked because suspension is not allowed if a channel is still running; stm32_dma3_pm_resume(), where the channel semaphore is restored if it was taken before suspend. Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com> Link: https://patch.msgid.link/20251121-dma3_improv-v2-3-76a207b13ea6@foss.st.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: stm32-dma3: introduce channel semaphore helpersAmelie Delaunay
Before restoring semaphore status after suspend, introduce new functions to handle semaphore operations : - stm32_dma3_get_chan_sem() to take the semaphore - stm32_dma3_put_chan_sem() to release the semaphore Also, use a new boolean variable semaphore_taken, which is true when the semaphore has been taken and false when it has been released. Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com> Link: https://patch.msgid.link/20251121-dma3_improv-v2-2-76a207b13ea6@foss.st.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: stm32-dma3: use module_platform_driverAmelie Delaunay
Without module_platform_driver(), stm32-dma3 doesn't have a module_exit procedure. Once stm32-dma3 module is inserted, it can't be removed, marked busy. Use module_platform_driver() instead of subsys_initcall() to register (insmod) and unregister (rmmod) stm32-dma3 driver. Reviewed-by: Eugen Hristev <eugen.hristev@linaro.org> Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com> Link: https://patch.msgid.link/20251121-dma3_improv-v2-1-76a207b13ea6@foss.st.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: pl08x: Fix a spelling mistakeChu Guangqing
"Accound" is an archaic spelling variant of "account". It had completely fallen out of formal use as early as the 17th century, when the spelling of Modern English became standardized. Here, it is corrected to "account" to enhance comprehension. Signed-off-by: Chu Guangqing <chuguangqing@inspur.com> Link: https://patch.msgid.link/20251125015734.1572-1-chuguangqing@inspur.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVEDJason Gunthorpe
syzkaller found it could overflow math in the test infrastructure and cause a WARN_ON by corrupting the reserved interval tree. This only effects test kernels with CONFIG_IOMMUFD_TEST. Validate the user input length in the test ioctl. Fixes: f4b20bb34c83 ("iommufd: Add kernel support for testing iommufd") Link: https://patch.msgid.link/r/0-v1-cd99f6049ba5+51-iommufd_syz_add_resv_jgg@nvidia.com Reviewed-by: Samiullah Khawaja <skhawaja@google.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Tested-by: Yi Liu <yi.l.liu@intel.com> Reported-by: syzbot+57fdb0cf6a0c5d1f15a2@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69368129.a70a0220.38f243.008f.GAE@google.com Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2025-12-16dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" ↵Suraj Gupta
property is missing When device tree lacks optional "xlnx,addrwidth" property, the addr_width variable remained uninitialized with garbage values, causing incorrect DMA mask configuration and subsequent probe failure. The fix ensures a fallback to the default 32-bit address width when this property is missing. Signed-off-by: Suraj Gupta <suraj.gupta2@amd.com> Fixes: b72db4005fe4 ("dmaengine: vdma: Add 64 bit addressing support to the driver") Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Reviewed-by: Folker Schwesinger <dev@folker-schwesinger.de> Link: https://patch.msgid.link/20251021183006.3434495-1-suraj.gupta2@amd.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: tegra-adma: Fix use-after-freeSheetal
A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. The issue occurs when the DMA buffer is freed by tegra_adma_terminate_all() before the vchan completion tasklet finishes accessing it. The race condition follows this sequence: 1. DMA transfer completes, triggering an interrupt that schedules the completion tasklet (tasklet has not executed yet) 2. Audio playback stops, calling tegra_adma_terminate_all() which frees the DMA buffer memory via kfree() 3. The scheduled tasklet finally executes, calling vchan_complete() which attempts to access the already-freed memory Since tasklets can execute at any time after being scheduled, there is no guarantee that the buffer will remain valid when vchan_complete() runs. Fix this by properly synchronizing the virtual channel completion: - Calling vchan_terminate_vdesc() in tegra_adma_stop() to mark the descriptors as terminated instead of freeing the descriptor. - Add the callback tegra_adma_synchronize() that calls vchan_synchronize() which kills any pending tasklets and frees any terminated descriptors. Crash logs: [ 337.427523] BUG: KASAN: use-after-free in vchan_complete+0x124/0x3b0 [ 337.427544] Read of size 8 at addr ffff000132055428 by task swapper/0/0 [ 337.427562] Call trace: [ 337.427564] dump_backtrace+0x0/0x320 [ 337.427571] show_stack+0x20/0x30 [ 337.427575] dump_stack_lvl+0x68/0x84 [ 337.427584] print_address_description.constprop.0+0x74/0x2b8 [ 337.427590] kasan_report+0x1f4/0x210 [ 337.427598] __asan_load8+0xa0/0xd0 [ 337.427603] vchan_complete+0x124/0x3b0 [ 337.427609] tasklet_action_common.constprop.0+0x190/0x1d0 [ 337.427617] tasklet_action+0x30/0x40 [ 337.427623] __do_softirq+0x1a0/0x5c4 [ 337.427628] irq_exit+0x110/0x140 [ 337.427633] handle_domain_irq+0xa4/0xe0 [ 337.427640] gic_handle_irq+0x64/0x160 [ 337.427644] call_on_irq_stack+0x20/0x4c [ 337.427649] do_interrupt_handler+0x7c/0x90 [ 337.427654] el1_interrupt+0x30/0x80 [ 337.427659] el1h_64_irq_handler+0x18/0x30 [ 337.427663] el1h_64_irq+0x7c/0x80 [ 337.427667] cpuidle_enter_state+0xe4/0x540 [ 337.427674] cpuidle_enter+0x54/0x80 [ 337.427679] do_idle+0x2e0/0x380 [ 337.427685] cpu_startup_entry+0x2c/0x70 [ 337.427690] rest_init+0x114/0x130 [ 337.427695] arch_call_rest_init+0x18/0x24 [ 337.427702] start_kernel+0x380/0x3b4 [ 337.427706] __primary_switched+0xc0/0xc8 Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA") Signed-off-by: Sheetal <sheetal@nvidia.com> Acked-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20251110142445.3842036-1-sheetal@nvidia.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failureZhen Ni
When fsl_edma_alloc_chan_resources() fails after clk_prepare_enable(), the error paths only free IRQs and destroy the TCD pool, but forget to call clk_disable_unprepare(). This causes the channel clock to remain enabled, leaking power and resources. Fix it by disabling the channel clock in the error unwind path. Fixes: d8d4355861d8 ("dmaengine: fsl-edma: add i.MX8ULP edma support") Cc: stable@vger.kernel.org Suggested-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Zhen Ni <zhen.ni@easystack.cn> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251014090522.827726-1-zhen.ni@easystack.cn Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()Guodong Xu
Add proper locking in mmp_pdma_residue() to prevent use-after-free when accessing descriptor list and descriptor contents. The race occurs when multiple threads call tx_status() while the tasklet on another CPU is freeing completed descriptors: CPU 0 CPU 1 ----- ----- mmp_pdma_tx_status() mmp_pdma_residue() -> NO LOCK held list_for_each_entry(sw, ..) DMA interrupt dma_do_tasklet() -> spin_lock(&desc_lock) list_move(sw->node, ...) spin_unlock(&desc_lock) | dma_pool_free(sw) <- FREED! -> access sw->desc <- UAF! This issue can be reproduced when running dmatest on the same channel with multiple threads (threads_per_chan > 1). Fix by protecting the chain_running list iteration and descriptor access with the chan->desc_lock spinlock. Signed-off-by: Juan Li <lijuan@linux.spacemit.com> Signed-off-by: Guodong Xu <guodong@riscstar.com> Link: https://patch.msgid.link/20251216-mmp-pdma-race-v1-1-976a224bb622@riscstar.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16cpufreq: dt-platdev: Fix creating device on OPPv1 platformsKrzysztof Kozlowski
Commit 6ea891a6dd37 ("cpufreq: dt-platdev: Simplify with of_machine_get_match_data()") broke several platforms which did not have OPPv2 proprety, because it incorrectly checked for device match data after first matching from "allowlist". Almost all of "allowlist" match entries do not have match data and it is expected to create platform device for them with empty data. Fix this by first checking if platform is on the allowlist with of_machine_device_match() and only then taking the match data. This duplicates the number of checks (we match against the allowlist twice), but makes the code here much smaller. Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> Closes: https://lore.kernel.org/all/CAMuHMdVJD4+J9QpUUs-sX0feKfuPD72CO0dcqN7shvF_UYpZ3Q@mail.gmail.com/ Reported-by: Pavel Pisa <pisa@fel.cvut.cz> Closes: https://lore.kernel.org/all/6hnk7llbwdezh74h74fhvofbx4t4jihel5kvr6qwx2xuxxbjys@rmwbd7lkhrdz/ Fixes: 6ea891a6dd37 ("cpufreq: dt-platdev: Simplify with of_machine_get_match_data()") Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Link: https://patch.msgid.link/20251210051718.132795-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-12-16arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing ↵Jianpeng Chang
reorder Commit 8a6e02d0c00e ("of: reserved_mem: Restructure how the reserved memory regions are processed") changed the processing order of reserved memory regions, causing elfcorehdr to overlap with dynamically allocated reserved memory regions during kdump kernel boot. The issue occurs because: 1. kexec-tools allocates elfcorehdr in the last crashkernel reserved memory region and passes it to the second kernel 2. The problematic commit moved dynamic reserved memory allocation (like bman-fbpr) to occur during fdt_scan_reserved_mem(), before elfcorehdr reservation in fdt_reserve_elfcorehdr() 3. bman-fbpr with 16MB alignment requirement can get allocated at addresses that overlap with the elfcorehdr location 4. When fdt_reserve_elfcorehdr() tries to reserve elfcorehdr memory, overlap detection identifies the conflict and skips reservation 5. kdump kernel fails with "Unable to handle kernel paging request" because elfcorehdr memory is not properly reserved The boot log: Before 8a6e02d0c00e: OF: fdt: Reserving 1 KiB of memory at 0xf4fff000 for elfcorehdr OF: reserved mem: 0xf3000000..0xf3ffffff bman-fbpr After 8a6e02d0c00e: OF: reserved mem: 0xf4000000..0xf4ffffff bman-fbpr OF: fdt: elfcorehdr is overlapped Fix this by ensuring elfcorehdr reservation occurs before dynamic reserved memory allocation. Fixes: 8a6e02d0c00e ("of: reserved_mem: Restructure how the reserved memory regions are processed") Signed-off-by: Jianpeng Chang <jianpeng.chang.cn@windriver.com> Link: https://patch.msgid.link/20251205015934.700016-1-jianpeng.chang.cn@windriver.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-12-16efi: Support EDID informationThomas Zimmermann
In the EFI config table, rename LINUX_EFI_SCREEN_INFO_TABLE_GUID to LINUX_EFI_PRIMARY_DISPLAY_TABLE_GUID. Read sysfb_primary_display from the entry. In addition to the screen_info, the entry now also contains EDID information. In libstub, replace struct screen_info with struct sysfb_display_info from the kernel's sysfb_primary_display and rename functions accordingly. Transfer it to the runtime kernel using the kernel's global state or the LINUX_EFI_PRIMARY_DISPLAY_TABLE_GUID config-table entry. With CONFIG_FIRMWARE_EDID=y, libstub now transfers the GOP device's EDID information to the kernel. If CONFIG_FIRMWARE_EDID=n, EDID information is disabled. Make the Kconfig symbol CONFIG_FIRMWARE_EDID available with EFI. Setting the value to 'n' disables EDID support. Also rename screen_info.c to primary_display.c and adapt the contained comment according to the changes. Link: https://lore.kernel.org/all/20251126160854.553077-8-tzimmermann@suse.de/ Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> [ardb: depend on EFI_GENERIC_STUB not EFI, fix conflicts after dropping the preceding patch from the series] Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2025-12-16sysfb: Move edid_info into sysfb_primary_displayThomas Zimmermann
Move x86's edid_info into sysfb_primary_display as a new field named edid. Adapt all users. An instance of edid_info has only been defined on x86. With the move into sysfb_primary_display, it becomes available on all architectures. Therefore remove this contraint from CONFIG_FIRMWARE_EDID. x86 fills the EDID data from boot_params.edid_info. DRM drivers pick up the raw data and make it available to DRM clients. Replace the drivers' references to edid_info and instead use the sysfb_display_info as passed from sysfb. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2025-12-16sysfb: Pass sysfb_primary_display to devicesThomas Zimmermann
Instead of screen_info, store a copy of sysfb_primary_display as device data. Pick it up in drivers. Later changes will add additional data to the display info, such as EDID information. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Richard Lyu <richard.lyu@suse.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2025-12-16sysfb: Replace screen_info with sysfb_primary_displayThomas Zimmermann
Replace the global screen_info with sysfb_primary_display of type struct sysfb_display_info. Adapt all users of screen_info. Instances of screen_info are defined for x86, loongarch and EFI, with only one instance compiled into a specific build. Replace all of them with sysfb_primary_display. All existing users of screen_info are updated by pointing them to sysfb_primary_display.screen instead. This introduces some churn to the code, but has no impact on functionality. Boot parameters and EFI config tables are unchanged. They transfer screen_info as before. The logic in EFI's alloc_screen_info() changes slightly, as it now returns the screen field of sysfb_primary_display. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Ard Biesheuvel <ardb@kernel.org> Acked-by: Bjorn Helgaas <bhelgaas@google.com> # drivers/pci/ Reviewed-by: Richard Lyu <richard.lyu@suse.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2025-12-16efi: sysfb_efi: Reduce number of references to global screen_infoThomas Zimmermann
Replace usage of global screen_info with local pointers. This will later reduce churn when screen_info is being moved. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Richard Lyu <richard.lyu@suse.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2025-12-16efi: earlycon: Reduce number of references to global screen_infoThomas Zimmermann
Replace usage of global screen_info with local pointers. This will later reduce churn when screen_info is being moved. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Richard Lyu <richard.lyu@suse.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2025-12-16efi: sysfb_efi: Fix efidrmfb and simpledrmfb on Valve Steam DeckTvrtko Ursulin
Valve Steam Deck has a 800x1280 portrait screen installed in a landscape orientation. The firmware offers a software-rotated 1280x800 mode, which GRUB can be made to switch to when displaying a boot menu. If this mode was selected frame buffer drivers will see this fake mode and fbcon rendering will be corrupted. Let us therefore add a selective quirk inside the current "swap with and height" handling, which will detect this exact mode and fix it up back to the native one. This will allow the DRM-based framebuffer drivers to detect the correct mode, apply the existing panel orientation quirk, and render the console in landscape mode with no corruption. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Ard Biesheuvel <ardb@kernel.org> Cc: Melissa Wen <mwen@igalia.com> Cc: linux-efi@vger.kernel.org Tested-by: Melissa Wen <mwen@igalia.com> # v3 Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> [ardb: use local var to refer to screen_info] Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2025-12-16efi: sysfb_efi: Convert swap width and height quirk to a callbackTvrtko Ursulin
Convert the swapping of width and height quirk to a callback. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Suggested-by: Ard Biesheuvel <ardb@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Ard Biesheuvel <ardb@kernel.org> Cc: Melissa Wen <mwen@igalia.com> Cc: linux-efi@vger.kernel.org Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Tested-by: Melissa Wen <mwen@igalia.com> # v3 [ardb: use local var to refer to screen_info] Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2025-12-16efi: sysfb_efi: Fix lfb_linelength calculation when applying quirksTvrtko Ursulin
PIXEL_BIT_MASK formats can have either less or more than four bytes per pixel so lets fix the lfb_linelenght calculation when applying the swapped width and height quirks. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Suggested-by: Thomas Zimmermann <tzimmermann@suse.de> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Ard Biesheuvel <ardb@kernel.org> Cc: Melissa Wen <mwen@igalia.com> Cc: linux-efi@vger.kernel.org Tested-by: Melissa Wen <mwen@igalia.com> # v3 Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2025-12-16efi: sysfb_efi: Replace open coded swap with the macroTvrtko Ursulin
Replace the open coded width height swap with the standard macro. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Suggested-by: Thomas Zimmermann <tzimmermann@suse.de> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Ard Biesheuvel <ardb@kernel.org> Cc: Melissa Wen <mwen@igalia.com> Cc: linux-efi@vger.kernel.org Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Tested-by: Melissa Wen <mwen@igalia.com> # v3 Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2025-12-16gpu: nova-core: gsp: replace firmware version with "bindings" aliasAlexandre Courbot
We have an "bindings" alias to avoid having to mention the firmware version again and again, and limit the diff when upgrading the firmware. Use it where we neglected to. Fixes: eaf0989c77e4 ("gpu: nova-core: Add bindings required by GSP sequencer") Reviewed-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20251216-nova-fixes-v3-4-c7469a71f7c4@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2025-12-16gpu: nova-core: bindings: derive `MaybeZeroable`Alexandre Courbot
Commit 4846300ba8f9 ("rust: derive `Zeroable` for all structs & unions generated by bindgen where possible") automatically derives `MaybeZeroable` for all bindings. This is better than selectively deriving `Zeroable` as it ensures all types that can implement `Zeroable` do. Regenerate the nova-core bindings so they benefit from this, and remove a now unneeded implementation of `Zeroable`. Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling") Reviewed-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20251216-nova-fixes-v3-3-c7469a71f7c4@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2025-12-16gpu: nova-core: gsp: fix length of received messagesAlexandre Courbot
The size of messages' payload is miscalculated, leading to extra data passed to the message handler. While this is not a problem with our current set of commands, others with a variable-length payload may misbehave. Fix this by introducing a method returning the payload size and using it. Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling") Reviewed-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com> Reviewed-by: Alistair Popple <apopple@nvidia.com> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20251216-nova-fixes-v3-2-c7469a71f7c4@nvidia.com [acourbot@nvidia.com: update `PANIC:` comments as pointed out by Joel.] Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2025-12-16dmaengine: qcom: bam_dma: use lock guardsBartosz Golaszewski
Simplify locking across the driver with lock guards from cleanup.h. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Link: https://patch.msgid.link/20251106-qcom-bam-dma-refactor-v1-2-0e2baaf3d81a@linaro.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16dmaengine: qcom: bam_dma: order includes alphabeticallyBartosz Golaszewski
For easier maintenance and better readability order all includes alphabetically. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://patch.msgid.link/20251106-qcom-bam-dma-refactor-v1-1-0e2baaf3d81a@linaro.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16gpu: nova-core: bindings: add missing explicit paddingAlexandre Courbot
Explicit padding is needed in order to avoid uninitialized bytes and safely implement `AsBytes`. The `--explicit-padding` of bindgen was omitted by mistake when these bindings were generated. Fixes: 13f85988d4fa ("gpu: nova-core: gsp: Retrieve GSP static info to gather GPU information") Reviewed-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20251216-nova-fixes-v3-1-c7469a71f7c4@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2025-12-16gpu: nova-core: select RUST_FW_LOADER_ABSTRACTIONSAlexandre Courbot
RUST_FW_LOADER_ABSTRACTIONS was depended on by NOVA_CORE, but NOVA_CORE is selected by DRM_NOVA. This creates a situation where, if DRM_NOVA is selected, NOVA_CORE gets enabled but not RUST_FW_LOADER_ABSTRACTIONS, which results in a build error. Since the firmware loader is an implementation detail of the driver, it should be enabled along with it, so change the "depends on" to a "select". Fixes: 54e6baf123fd ("gpu: nova-core: add initial driver stub") Closes: https://lore.kernel.org/oe-kbuild-all/202512061721.rxKGnt5q-lkp@intel.com/ Tested-by: Alyssa Ross <hi@alyssa.is> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20251106-b4-select-rust-fw-v3-2-771172257755@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2025-12-16dmaengine: dw-edma: Fix confusing cleanup.h syntaxKrzysztof Kozlowski
Initializing automatic __free variables to NULL without need (e.g. branches with different allocations), followed by actual allocation is in contrary to explicit coding rules guiding cleanup.h: "Given that the "__free(...) = NULL" pattern for variables defined at the top of the function poses this potential interdependency problem the recommendation is to always define and assign variables in one statement and not group variable definitions at the top of the function when __free() is used." Code does not have a bug, but is less readable and uses discouraged coding practice, so fix that by moving declaration to the place of assignment. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20251208020729.4654-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-16firmware: arm_scmi: Increase performance MAX_OPPS limit to 64Vivek Aknurwar
Some platforms expose more than 32 operating performance points (OPPs) per performance domain via the SCMI performance protocol, but the driver currently limits the number of OPPs it can handle to 32 via MAX_OPPS. Bump MAX_OPPS to 64 so that these platforms can register all their performance levels. This is an internal limit in the driver only and does not affect the SCMI protocol ABI. 64 is chosen as the next power of two above the existing limit. Signed-off-by: Vivek Aknurwar <vivek.aknurwar@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Alexey Klimov <alexey.klimov@linaro.org> Message-Id: <20251014073454.461999-1-vivek.aknurwar@oss.qualcomm.com> (sudeep.holla: Updated commit log to reflect driver limitation rather than spec) Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
2025-12-16firmware: arm_scmi: Move boiler plate code into the get info functionsDan Carpenter
This code to check whether the selector is valid and if the item has already been recorded in the array can be moved to the scmi_pinctrl_get_function_info() type functions. That way it's in one place instead of duplicated in each of the callers. Remove the check for if "pi->nr_groups == 0" because if that were the case then "selector >= pi->nr_groups" would already be true. It already was not checked for the pin case so this makes things a bit more uniform. Also remove the check for if (!pin) since pin is an offset into the middle of an array and can't be NULL. Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Cristian Marussi <cristian.marussi@arm.com> Message-Id: <287b5302f583e3535d50617ec3b0856e38253171.1761576798.git.dan.carpenter@linaro.org> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>