summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
10 daysmedia: qcom: iris: Remove dead assignment in iris_hfi_gen2_set_tier()Dikshita Agarwal
Fold the ternary initialiser directly into the variable declaration, removing the dead store that was immediately overwritten. Reviewed-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
10 daysmedia: qcom: iris: Fix bitmask test in iris_allow_cmd()Dikshita Agarwal
iris_allow_cmd() incorrectly checks a sub‑state flag using a logical equality comparison. Since sub_state is a bitmask, this allows STOP to pass when IRIS_INST_SUB_DRAIN is set alongside other bits, violating the intended drain semantics. Fix this by using a proper bitmask test. Fixes: d09100763bed ("media: iris: add support for drain sequence") Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
10 daysmedia: qcom: iris: Centralize internal buffer table selectionDikshita Agarwal
Internal buffer table dispatch is duplicated across multiple Iris code paths, which is error‑prone and makes future changes harder to reason about. Consolidate the buffer dispatch logic into a single helper so that table selection is defined in exactly one place and keep call sites minimal. No functional change intended. Reviewed-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
10 daysmedia: venus: fix payload size calculation in parse_raw_formats()Mohammed EL Kadiri
The consumed size is computed after the loop using the num_planes value from the last iteration for all entries. When entries have different plane counts, this produces an incorrect total. Accumulate the actual size during the loop instead. Fixes: 9edaaa8e3e15 ("media: venus: hfi_parser: refactor hfi packet parsing logic") Cc: stable@vger.kernel.org Signed-off-by: Mohammed EL Kadiri <med08elkadiri@gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
10 daysmedia: venus: fix payload size returned by parse_caps() and parse_alloc_mode()Mohammed EL Kadiri
parse_caps() and parse_alloc_mode() return only the size of their fixed header fields, excluding the flexible array payload. hfi_parser() uses this return value to advance through the firmware response buffer, so underreporting causes parser desynchronization. Return the full consumed size (header + entries), matching the correct pattern used by parse_profile_level(). Fixes: 9edaaa8e3e15 ("media: venus: hfi_parser: refactor hfi packet parsing logic") Cc: stable@vger.kernel.org Signed-off-by: Mohammed EL Kadiri <med08elkadiri@gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
10 daysmedia: qcom: iris: fix missing hfi_id in gen1 GOP_SIZE capWangao Wang
Add hfi_id to gen1 encoder GOP_SIZE cap and replace the set function, remove the redundant INTRA_PERIOD cap. Fixes: d22037f3fd33 ("media: iris: Set platform capabilities to firmware for encoder video device") Reviewed-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com> Signed-off-by: Wangao Wang <wangao.wang@oss.qualcomm.com> Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com> Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
10 daysmedia: qcom: iris: fix runtime PM reference leaksHungyu Lin
Use pm_runtime_resume_and_get() in iris_enable_power_domains() to avoid leaking a runtime PM usage count on failure. Also ensure pm_runtime_put_sync() is always called in iris_disable_power_domains(), even when iris_opp_set_rate() fails, so runtime PM references remain balanced. Fixes: bb8a95aa038e ("media: iris: implement power management") Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
10 daysmedia: qcom: iris: fix state-change debug log printing stale valueDikshita Agarwal
The state‑change debug log in iris_inst_change_state() always prints the same value for the old and new state, rendering it useless for debugging. This happens because the state is updated before the log is emitted. Log the transition before updating the state so the previous value is preserved, consistent with the existing sub‑state handling. Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops") Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com> Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysdrm/amd/amdgpu: remove duplicated code in gfx_v11 and gfx_v12Ulisses Paixao
The functions gfx_v11_0_handle_priv_fault and gfx_v12_0_handle_priv_fault share the same logic for searching and triggering a scheduler fault on a ring. This patch moves the shared ring-searching logic to a common function, amdgpu_gfx_handle_priv_fault, in amdgpu_gfx.c. The hardware-specific decoding of ring IDs remains in the version-specific files to maintain proper architectural separation. Signed-off-by: Ulisses Paixao <ulissespaixao@usp.br> Co-developed-by: Felipe Sousa <felipesousa@usp.br> Signed-off-by: Felipe Sousa <felipesousa@usp.br> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
11 daysdrm/amdgpu/gfx7: Enable IP block soft reset as a GPU recovery methodTimur Kristóf
Enable IP block soft reset as a GPU recovery method for GFX7 graphics and compute rings. This improves current user experience on all GFX7 chips: * On Kaveri and Kabini there is currently no working GPU recovery method so those chips currently require the user to manually reset the computer when there was a hang. * On Hawaii and Bonaire, the current GPU recovery method always clears the contents of VRAM, which means that a buggy (hanging) app can crash the whole graphical session, which is less than ideal. Using GFX IP block soft reset means that we can now have a working recovery on GFX7 APUs and we can also move on from GFX hangs on dGPUs without crashing the whole system. Tested with the "hard_reset_cp_wait" test case from the Hang Test Suite created by Natalie Vock and Konstantin Seurer. This Vulkan testcase waits for an event that never occurs, effectively a WAIT_REG_MEM packet that intentionally hangs. IP block soft reset can resolve that hang and allow the rest of the system to move on and keep functioning without needing a full ASIC reset. Tested on the following chips: Bonaire (Radeon HD 7790) Hawaii (Radeon R9 390X) Kaveri (A10-7850K) Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
11 daysdrm/amdgpu/gfx7: Fixup IP block soft resetTimur Kristóf
Use basically the same implementation as GFX8, except for the GFX7 specific MQD functions. Reset every block using the GRBM, then proceed to reset the GRBM and SEM blocks using the SRBM. Remove the redundant gfx_v7_0_update_cg() function. The soft reset now calls the clock and powergating functions of the IP block instead. Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
11 daysdrm/amdgpu/gfx7: Use COND_EXECTimur Kristóf
COND_EXEC tells the CP to discard the dwords following it when its condition is zero (false). This is useful for GPU recovery because it can help reduce collateral damage during GFX IP block soft reset, meaning that it reduces the likelyhood that we fail some jobs which are not guilty of the hang as the IP block soft reset mechanism clears the condition before doing the reset. Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
11 daysdrm/amdgpu/gfx7: Clean up gfx ring during resetTimur Kristóf
Clear the WPTR and RPTR at ring initialization. Additionally clear the ring contents during reset. After a reset, the ring contents could be "dirty" and contain packets emitted before the reset. and thus need to be cleared to prevent the command processor from executing packets left over in the ring from before the reset. Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
11 daysdrm/amdgpu/gfx7: Fixup emitting SWITCH_BUFFER packetsTimur Kristóf
This packet is interpreted by the CE (constant engine). The reason why this packet is emitted is basically to make sure the CE can't start executing packets from the next job submission until the current one is finished. (Note that CE is not utilized by any maintained userspace driver and is discontinued in new GPUs. It is now also deprecated in the kernel.) Implement the emit_switch_buffer() function instead of emitting them duing emit_ib, emit_pipeline_sync and emit_vm_flush. It isn't necessary to emit these in both emit_pipeline_sync() and emit_vm_flush() because amdgpu_vm_flush() already calls these when calling either of those functions. Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
11 daysdrm/amdgpu/gfx7: Return error code when failing to start GFX ringTimur Kristóf
Return an error code instead of silently failing. Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
11 daysdrm/amdgpu/gfx7: Return error code when compute ring tests failTimur Kristóf
The gfx_v7_0_cp_compute_resume() function should only return success when all compute rings are actually functional. This will be especially important for soft reset which needs this to know whether the reset was successful. Note that the gfx_v8_0_cp_test_all_rings() function already does this on GFX8, here we just follow the same idea. Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
11 daysdrm/amdgpu/gfx7: Refactor MQD initialization and finalizationTimur Kristóf
Call amdgpu_gfx_mqd_sw_init()/_fini() on GFX7 to initialize and finalize MQD BOs, just like GFX8 and newer; instead of doing an ad-hoc BO allocation. Introduce the possibility of backing up the MQD instead of trying to reinitialize every time. This solves an issue with GFX IP block soft reset where all compute rings would hang after the reset. Rename gfx_v7_0_mqd_deactivate() to gfx_v7_0_deactivate_hqd() to more closely reflect what it does and for consistency with the GFX8 code. Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
11 daysdrm/amdgpu/gfx7: Make amdgpu_gfx_mqd_sw_init() usable on GFX7Timur Kristóf
GFX7 supports KIQ, but amdgpu doesn't use it. Change amdgpu_gfx_mqd_sw_init() to only allocate the MQD BO for the KIQ on GFX8 and newer (that is, TOPAZ and newer). This makes amdgpu_gfx_mqd_sw_init() usable on GFX7 without any further changes to its functionality. Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
11 daysdrm/amd/display: Exit idle optimizations before programmingLeo Li
[Why] We need to exit PSR/IPS before programming. Before calling DC for programming in amdgpu_dm_commit_planes(), there's a vblank_control_workqueue flush. This waits for IPS and PSR exit. (See drm_vblank_on/off() > amdgpu_dm_crtc_set_vblank() --queue_work()-> amdgpu_dm_crtc_vblank_control_worker()) Prior to the tagged "Fixes:" change, drm_vblank_get() was called before the workqueue flush. This ordering ensures that PSR exit occurred before programming. After the "Fixes:" change, drm_vblank_get() is called after the workqueue flush, leading to programming while idle optimizations are still active. This can lead to incorrect flip_pending detection used by vblank event delivery. [How] Split the vblank_get() component of `dm_arm_vblank_event()` into `dm_arm_vblank_event_pre_programming()`, which is called before programming. Call it before the vblank_control_workqueue flush. Includes a drive-by cleanup of prepare_flip_isr(): the only caller is dm_arm_vblank_event() and it's simple enough to roll-in. v2: Fix checkpatch formatting warning on drm_arm_vblank_event_pre_programming() arg alignment. Fixes: f64a9be56536 ("drm/amd/display: check GRPH_FLIP status before sending event") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/4141#note_3583205 Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5527 Assisted-by: Codex:gpt-5.6-sol Assisted-by: Claude:opus-5 Suggested-by: David Weber <weber.aulendorf@gmail.com> Signed-off-by: Leo Li <sunpeng.li@amd.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
11 daysdrm/amdkfd: Remove svm_bo eviction fencePhilip Yang
SVM BOs are now migrated back to system memory synchronously from the TTM eviction path (svm_range_evict_svm_bo), so the per-svm_bo eviction fence is no longer used. Remove the eviction fence from svm_range_bo, drop the amdgpu_amdkfd_fence->svm_bo back pointer and the amdgpu_amdkfd_evict_svm_bo() helper, and stop special-casing svm_bo fences in the KFD fence enable_signaling and check_mm paths. Embed struct amdgpu_bo directly in svm_range_bo with a dedicated svm_range_bo_destroy() callback, and keep the owning mm via mmgrab()/mmdrop() instead of through the fence. Signed-off-by: Philip Yang <Philip.Yang@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
11 daysdrm/amd/pm: hide pp_table sysfs on APUsYang Wang
APUs use firmware-owned DPM tables and do not support replacement through pp_table. Generic callbacks can nevertheless expose the sysfs file and accept an upload before resetting the power management stack. Treat pp_table as unsupported on APUs. Use the same platform check in the get and set paths to hide the file and reject uploads. Fixes: 289921b03fe5 ("drm/amd/powerplay: implement sysfs of pp_table for smu11 (v2)") Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
11 daysMerge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
Pull kvm fixes from Paolo Bonzini: "arm64: - Fix a tiny buglet when propagating the deactivation of an interrupt from a nested guest, which happened to trigger a gold plated CPU bug on a particular implementation - Fix a race between LPI unmapping and mapping, resulting in leaked LPIs - Make LPI mapping more robust on memory allocation failure - Fix the handling of the EL2 tracing clock being disabled - A couple of Sashiko-driven fixes for corner cases in the EL2 tracing code - Add missing sysreg tracepoint for the EL2 code - Tidy-up the mutual exclusion of guest-memfd and MTE - Update Fuad's email address to point to @linux.dev s390: - several fixes for PCI passthru in s390 kvm - fix a 7.2-rc regression in the adapter interrupt mapping code x86: - Add memory clobber to asm for VMX instructions; without one, the compiler could reorder them in troublesome ways because "asm volatile" and "asm goto" only protect against removal of the asm. - Cancel delayed I/O APIC EOI handling before destroying vCPUs - Check all address spaces (normal and SMM) for write tracking and large pages, not just the current one. - Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if not running L1. If the deactivation is VM-wide rather than being caused by something in L2's vCPU state, after a nested vmexit L1 will be able to access the host's APIC state" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (21 commits) KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active KVM: x86/mmu: Check all address spaces before skipping unsync KVM: x86/mmu: Check write tracking in all address spaces KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs KVM: VMX: add memory clobber to asm for VMX instructions KVM: s390: Fall back to short-term pinning in MAP ioctl KVM: s390: pci: Validate AIBV and AISB before pinning guest pages KVM: s390: pci: Fix resource leak on IRQ registration failure KVM: s390: pci: Fix NULL dereference on AIBV allocation failure KVM: s390: pci: Fix missing error codes and memory unaccounting KVM: s390: pci: Fix memory accounting for pinned/unpinned pages KVM: s390: pci: Reject adapter interrupt forwarding if already enabled KVM: arm64: Reject guest_memfd memslots when the VM has MTE KVM: arm64: Add missing hyp_enter when trapping sysreg KVM: arm64: Fix hyp_trace_desc allocation size in hyp_trace_load() KVM: arm64: Fix potential leak in hyp_trace_buffer_alloc_bpages_backing KVM: arm64: Fix hyp_trace clock disabling KVM: arm64: vgic: Mitigate potential LPI registration failure KVM: arm64: vgic: Fix race between LPI release and re-registration KVM: arm64: Update Fuad Tabba's email address ...
11 daysMerge branch 'i2c/i2c' into i2c/i2c-nextAndi Shyti
11 daysKVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is activeSean Christopherson
Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM is using a separate MSR bitmap to run L2. If AVIC is fully enabled prior to running L2, and is then inhibited while L2 is active (for a VM-scoped inhibit), then KVM will run L1 with AVIC disabled, but with x2APIC MSR intercepts disabled, i.e. will allow L1 to read most of the host's APIC state, send arbitrary interrupts, change task priority, and ultimately trivially DoS the host. E.g. sending a self-IPI in L1 on HYPERV_REENLIGHTENMENT_VECTOR, 0xee, with CONFIG_HYPERV=n in the host kernel as a "safe" PoC, yields: Spurious interrupt (vector 0xee) on CPU#425. Acked And hacking KVM to abuse kvm_set_posted_intr_wakeup_handler() to register a handler and WARN on POSTED_INTR_WAKEUP_VECTOR yields: ------------[ cut here ]------------ WARNING: arch/x86/kvm/svm/svm.c:5594 at pi_wakeup_handler+0x9/0x10 [kvm_amd], CPU#156: nested_x2apic_t/316940 CPU: 156 UID: 0 PID: 316940 Comm: nested_x2apic_t Tainted: G S U Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER Hardware name: Google Astoria-Turin/astoria, BIOS 0.20260209.0-0 02/09/2026 RIP: 0010:pi_wakeup_handler+0x9/0x10 [kvm_amd] Call Trace: <IRQ> sysvec_kvm_posted_intr_wakeup_ipi+0x64/0x80 </IRQ> <TASK> asm_sysvec_kvm_posted_intr_wakeup_ipi+0x1a/0x20 RIP: 0010:vcpu_run+0x1430/0x1e40 [kvm] kvm_arch_vcpu_ioctl_run+0x2c1/0x600 [kvm] kvm_vcpu_ioctl+0x580/0x6b0 [kvm] __se_sys_ioctl+0x6d/0xb0 do_syscall_64+0x10a/0x480 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x46ff4b </TASK> ---[ end trace 0000000000000000 ]--- Fixes: 091abbf578f9 ("KVM: x86: nSVM: optimize svm_set_x2apic_msr_interception") Cc: stable@vger.kernel.org Cc: Yosry Ahmed <yosry@kernel.org> Signed-off-by: Sean Christopherson <seanjc@google.com> Link: https://patch.msgid.link/20260729213558.639074-1-pbonzini@redhat.com/ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
11 daysi2c: core: support recovery for single-ended GPIOsJie Li
Currently, i2c_init_recovery() only assigns the set_sda/set_scl hooks if gpiod_get_direction() returns GPIO_LINE_DIRECTION_OUT. This logic fails on certain SoC controllers where open-drain lines in a high-impedance state are physically reported as inputs. This leads to a "deadlock" where the I2C core refuses to assign the recovery hooks because it incorrectly assumes the pins are input-only, even though they are fully capable of driving the bus low for recovery. Update the recovery initialization to use the new gpiod_is_single_ended() helper. If a GPIO is configured as open-drain or open-source in the firmware, it is safe to assume it can be used for bus recovery, even if the current hardware direction is reported as input. Signed-off-by: Jie Li <jie.i.li@nokia.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Acked-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20260511113726.49041-3-jie.i.li@nokia.com
11 daysarm64: dts: qcom: eliza: Describe the ADSP GPR nodeAbel Vesa
Describe the ADSP Generic Packet Router (GPR) devicetree node as part of audio subsystem on Qualcomm Eliza SoC. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260724-dts-qcom-eliza-add-gpr-v3-1-2595beb0cdec@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
11 daysarm64: dts: qcom: eliza-evk: Add support for USB and SD cardAbel Vesa
Even though the EVK comes with 3 Type-C ports, the Eliza EVK only has one USB controller and a single set of PHYs, which are connected to the port marked as JUSB. Also, the EVK comes with an SD card slot. So describe the PMIC GLINK node, the connector graph, the PHYs and repeater supplies and enable the USB controller. Also enable the second SD host controller, describe the card detect GPIO and the board specific supplies. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260724-dts-qcom-eliza-cqs-evk-enable-usb-sdcard-v3-1-eadf9da69226@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
11 daysdt-bindings: arm: qcom-soc: Allow WSA88xx speaker compatibleKrzysztof Kozlowski
One selects in this schema captures "^qcom,.*sa[0-9]+.*$" compatibles, because there are SAxxxx Qualcomm SoCs. Unfortunately there is also WSA8810 and WSA8855 I2C speakers, so they need listing too. Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260721-dt-bindings-qcom-soc-naming-v3-4-8f275c9d3412@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
11 daysdt-bindings: arm: qcom-soc: Validate nodes with fallbacksKrzysztof Kozlowski
The schema checking for expected naming patterns for SoC IP block nodes was really incomplete and was checking only nodes with single compatible. Fix this by changing "select:" to "contains:" so every node, except root nodes, having at least one matching compatible will be evaluated. This however will evaluate nodes which have some generic fallbacks (e.g. syscon), thus the schema for expected compatible should also have "contains:" (with "anyOf:"). These two above are the only functional changes in this commit and the rest of the diff is indentation change. None of the patterns are changed (neither in "Preferred naming style" group nor in "Legacy namings"), none of the compatibles are affected. Basically the second part of the diff is (simplifying): properties: compatible: - oneOf: - ...... + contains: + anyOf: + ...... Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260721-dt-bindings-qcom-soc-naming-v3-3-8f275c9d3412@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
11 daysdt-bindings: arm: qcom-soc: Document more of existing legacy style compatiblesKrzysztof Kozlowski
The schema misses several old style compatibles with SoC component trailing in the compatible (qcom,IP-SoC): - qcom,apss-wdt-x1e80100 - qcom,apss-wdt-xxx, qcom,rpm-xxx and qcom,scm-xxx for SoC with code names (like qcom,rpm-shikra) - qcom,kpss-gcc-xxx - qcom,rpmcc-xxx - qcom,tcsr-xxx - qcom,usb-hs-phy-xxx It also missed qcom,ipq806x-ahci. None of these were flagged by schema, because they were used with fallbacks and the schema checks only for single compatibles. Nevertheless document them for complete picture and for future change, which will apply the schema to fallbacks as well. Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260721-dt-bindings-qcom-soc-naming-v3-2-8f275c9d3412@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
11 daysdt-bindings: arm: qcom-soc: Include Eliza, Kaanapali and others in SoC namesKrzysztof Kozlowski
Grow the schema checking for proper SoC compatible naming style with recently upstreamed new Qualcomm SoCs: Eliza, Kaanapali, Hawi, Mahua, Maili, Nord and Shikra. The list covers only SoC IP blocks, thus no Hamoa or Talos in the names, because these are codenames but not used for SoC IP block naming. Since switching from model numbers to codenames, this list with explicit codenames will have to grow and list them all in order for the schema to work. It feels like a churn, but the compatible naming is still mess, for example, the schema pci/qcom,pcie-x1e80100.yaml with a legacy naming vendor,IP-SoC (qcom,pcie-x1e80100) received a new compatible with new style (qcom,glymur-pcie). Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260721-dt-bindings-qcom-soc-naming-v3-1-8f275c9d3412@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
11 daysarm64: dts: qcom: eliza: Fix DSI1 phy reference clock rateKrzysztof Kozlowski
The DSI PHY CXO clock input is the SoC CXO divided by two. DSI0 already uses correct one, but DSI1 got copy-paste from SM8750, which had same problem and copy-pasted code from SM8650. Wrong clock parent will cause incorrect DSI1 PHY PLL frequencies to be used making the DSI panel non-working, although there is no upstream user of DSI1. Fixes: 159d252ed800 ("arm64: dts: qcom: eliza: Add display (MDSS) with Display CC") Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260713125837.727632-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
11 daysarm64: dts: qcom: eliza: Enable cpufreq cooling devicesHaritha S K
Add cooling-cells property to the CPU nodes to support cpufreq cooling devices. Signed-off-by: Haritha S K <haritha.k@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260724-eliza-cpufreq-v1-1-38f01e47f0f1@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
11 daysaccel/qaic: use sizeof(*trans_hdr) for transaction length checkMuhammad Bilal
In encode_message() the per-transaction lower-bound check compares trans_hdr->len against sizeof(trans_hdr), i.e. the size of the pointer, instead of sizeof(*trans_hdr), the size of struct qaic_manage_trans_hdr. Every other length check in this file (encode_message() at the loop guard, decode_message(), etc.) correctly uses sizeof(*trans_hdr), so this is an inconsistency. On 64-bit builds the pointer and the struct are both 8 bytes, so the check is correct by coincidence and there is no behavioural change. On 32-bit builds the pointer is 4 bytes, which weakens the minimum-length check below the 8-byte header size. Use sizeof(*trans_hdr) so the check validates against the actual transaction header size on all builds. Fixes: ea33cb6fc278 ("accel/qaic: tighten bounds checking in encode_message()") Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Link: https://patch.msgid.link/20260617212520.59801-1-meatuni001@gmail.com
11 daysspi: Add trace event support for GENI SE registers dumpMark Brown
Praveen Talari <praveen.talari@oss.qualcomm.com> says: The GENI framework is used by multiple drivers including UART, I2C, and SPI. When hardware-related failures occur, each driver typically relies on local logging, which often lacks sufficient information to determine the exact controller state. This series introduces a common tracing mechanism for GENI Serial Engine debug registers and demonstrates its use in the SPI driver. Patch 1 adds a new tracepoint that captures an extensive set of GENI SE registers, including command state, interrupt status, FIFO state, DMA configuration, and clock-related information. Patch 2 hooks the tracepoint into SPI error paths so that register snapshots are automatically generated when timeouts or transfer-related failures occur. Usage examples: Enable all I2C traces: echo 1 > /sys/kernel/tracing/events/qcom_geni_se/enable cat /sys/kernel/debug/tracing/trace_pipe Example trace output: 114.291299: geni_se_regs: 888000.spi: m_cmd0=0x18000000 m_irq_status=0x00000080 s_cmd0=0x00000000 s_irq_status=0x08000000 geni_status=0x00000000 geni_ios=0x00000000 m_cmd_ctrl=0x00000000 m_cmd_err=0x00000000 m_fw_err=0x00000000 tx_fifo_sts=0x00000000 rx_fifo_sts=0x00000000 tx_watermark=0x00000000 rx_watermark=0x0000000d rx_watermark_rfr=0x0000000e m_gp_length=0x00000004 s_gp_length=0x00000000 dma_tx_irq=0x00000000 dma_rx_irq=0x00000000 dma_tx_irq_en=0x0000000f dma_rx_irq_en=0x0000001f dma_rx_len=0x00001400 dma_rx_len_in=0x00001400 dma_tx_len=0x00001400 dma_tx_len_in=0x00001400 dma_tx_ptr_l=0xffffc000 dma_tx_ptr_h=0x00000000 dma_rx_ptr_l=0xffffa000 dma_rx_ptr_h=0x00000000 dma_tx_attr=0x00000001 dma_tx_max_burst=0x00000002 dma_rx_attr=0x00000000 dma_rx_max_burst=0x00000002 dma_if_en=0x00000009 dma_if_en_ro=0x00000001 dma_general_cfg=0x0000000f dma_qsb_trans_cfg=0x00000000 dma_dbg=0x00000000 m_irq_en=0x7fc0007f s_irq_en=0x03003e3e gsi_event_en=0x00000000 se_irq_en=0x0000000f ser_m_clk_cfg=0x000000a1 ser_s_clk_cfg=0x00000000 general_cfg=0x00000048 output_ctrl=0x0000007f clk_ctrl_ro=0x00000001 fifo_if_dis=0x00000000 fw_multilock_msa=0x00000000 clk_sel=0x00000005 Link: https://patch.msgid.link/20260729-add-tracepoints-for-se-reg-dump-v4-0-08bbd63b0ed2@oss.qualcomm.com
11 daysspi: qcom-geni: add GENI SE registers trace event on error pathsPraveen Talari
The GENI SPI driver reports various transfer failures such as command timeouts, DMA reset timeouts, DMA transaction errors, and unexpected interrupt conditions. However, diagnosing the root cause of these failures is difficult as the hardware state is not captured when the error occurs. Add trace_geni_se_regs() calls at critical SPI error handling paths to automatically capture GENI serial engine debug registers when failures are detected. This includes: - M_CMD abort/cancel timeout - DMA TX/RX FSM reset timeout - DMA transaction failures and pending residue conditions - Unexpected interrupt error status - Premature transfer completion with pending TX/RX data Dumping the SE debug registers at the time of failure provides additional hardware context and significantly improves post-mortem analysis of SPI transfer issues without affecting normal operation. Acked-by: Mukesh Kumar Savaliya <mukesh.savaliya@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com> Link: https://patch.msgid.link/20260729-add-tracepoints-for-se-reg-dump-v4-2-08bbd63b0ed2@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
11 dayssoc: qcom: geni-se: trace: Add trace event support for GENI SE registers dumpPraveen Talari
Diagnosing GENI SE-based driver (serial, SPI, I2C) failures currently requires reading each hardware register individually, either through ad hoc debug code or a debugger. This is slow, requires the state to remain stable across the multiple reads, and cannot be run non-intrusively during normal operation without adding printk-style noise to each driver. Add a new trace event header for the Qualcomm GENI Serial Engine (SE) framework providing a geni_se_regs tracepoint. This tracepoint captures a comprehensive snapshot of the GENI SE hardware state in a single trace record, making it possible to correlate register values at a precise point in time without multiple sequential reads. The trace event records the following register groups: - Main/secondary command and IRQ status (M_CMD0, S_CMD0, M/S_IRQ_STATUS) - Engine status, IOS, and command control/error registers - TX/RX FIFO status and watermark registers (including RFR watermark) - M/S GP length registers - DMA TX/RX IRQ, enable, length, pointer, attribute, and burst registers - DMA interface enable, general config, QSB trans config, and debug - M/S IRQ enable, GSI event enable, and top-level SE IRQ enable - Serial master/slave clock config, general config, output control, clock control RO, FIFO interface disable, and FW multilock MSA - Clock select register Having all these registers captured atomically in a single ftrace record allows drivers built on top of the GENI SE framework (serial, SPI, I2C) to invoke this tracepoint on error paths and reconstruct the full engine state during post-mortem analysis without instrumenting each driver separately. Acked-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com> Link: https://patch.msgid.link/20260729-add-tracepoints-for-se-reg-dump-v4-1-08bbd63b0ed2@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
11 daysMerge branch 'i2c/i2c' into i2c/i2c-nextAndi Shyti
11 daysi2c: rcar: add R-Car Gen5 supportWolfram Sang
To support the next generation of R-Car SoCs, we need to skip polling the reset status. SCMI doesn't support it and the firmware must take care of this anyhow. Other than that, the driver works fine as-is. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20260727122546.4232-6-wsa+renesas@sang-engineering.com
11 daysdt-bindings: i2c: rcar-i2c: Document R-Car X5H supportMinh Le
Document support for rcar-i2c on R8A78000 (X5H) SoCs. Signed-off-by: Minh Le <minh.le.aj@renesas.com> [wsa: fixed white space issues, added reset requirement] Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20260727122546.4232-5-wsa+renesas@sang-engineering.com
11 daysaudit: fix potential use-after-free in audit_del_rule()Luxiao Xu
`audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()` before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in `audit_filter()` and `audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify mark can be freed on an independent lifetime path. This creates a use-after-free window during rule deletion. Fix this by unlinking the rule from the RCU-visible lists and invoking `synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other rule removal helpers). This ensures that all existing RCU readers have exited the critical section before any underlying resources are destroyed. Cc: stable@vger.kernel.org Fixes: 34d99af52ad4 ("audit: implement audit by executable") Reported-by: Vega <vega@nebusec.ai> Assisted-by: Codex:gpt-5.4 Signed-off-by: Luxiao Xu <rakukuip@gmail.com> Signed-off-by: Ren Wei <enjou1224z@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
11 daysaudit: fix potential integer overflow in audit_log_n_string()Zhan Xusheng
audit_log_n_string() computes new_len as "slen + 3" (enclosing quotes plus the NUL terminator) and stores it into an int, while slen is a size_t. For a sufficiently large slen the addition can overflow and/or the result be truncated when assigned to the int new_len, so the "new_len > avail" check can be bypassed and the subsequent memcpy(ptr, string, slen) can write past the skb tail. This is the same class of bug that was fixed for the hex sibling in commit 65dfde57d1e2 ("audit: fix potential integer overflow in audit_log_n_hex()"); both helpers are reached through audit_log_n_untrustedstring() with the same length source. Make new_len a size_t and use check_add_overflow() to catch the overflow, mirroring the audit_log_n_hex() fix. No functional change for the in-tree callers, which all pass bounded lengths. Cc: stable@vger.kernel.org Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings") Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
11 daysx86/CPU/AMD: Carve out a Zen5 models rangePratik Vishwakarma
Family 0x1a, model 0xd0..0xd7 belongs to the Zen5 generation. Carve it out from the larger, Zen6 range where former doesn't belong. [ bp: Rewrite commit message, add tags. ] Fixes: b5f53e6d3d32 ("x86/CPU/AMD: Add more Zen6 models") Signed-off-by: Pratik Vishwakarma <Pratik.Vishwakarma@amd.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Cc: <stable@kernel.org> Link: https://patch.msgid.link/20260729055459.15904-1-Pratik.Vishwakarma@amd.com
11 daysriscv: drop __init from vec_check_unaligned_access_speed_all_cpusAnirudh Srinivasan
This function runs within a kthread and need not necessarily finish before system finishes boot and free_initmem() unmaps the .init.text section. This function makes calls to SBI for probing unaligned access speed, and if this is slow for some reason (say some debug prints were added to SBI), the kthread can still be running at this point and result in an instruction page fault when trying to fetch from the freed region. [ 25.642087] Unable to handle kernel paging request at virtual address ffffffff80a04ef8 [ 25.646694] Current vec_check_unali pgtable: 4K pagesize, 48-bit VAs, pgdp=0x00004000316e9000 [ 25.653170] [ffffffff80a04ef8] pgd=000010004be7e401, p4d=000010004be7e401, pud=000010004be7e001, pmd=000010000c3000e3 [ 25.661244] Oops [#1] [ 25.662997] Modules linked in: [ 25.665357] CPU: 3 UID: 0 PID: 42 Comm: vec_check_unali Not tainted 7.0.0-tt-blackhole-asrinivasan-00007-g30ff73f18211 #570 PREEMPTLAZY [ 25.674669] Hardware name: Tenstorrent Blackhole (DT) [ 25.678545] epc : vec_check_unaligned_access_speed_all_cpus+0x18/0x2c [ 25.683458] ra : vec_check_unaligned_access_speed_all_cpus+0x18/0x2c [ 25.688372] epc : ffffffff80a04ef8 ra : ffffffff80a04ef8 sp : ffff8f8000203e20 [ 25.693874] gp : ffffffff814dc168 tp : ffffaf8001ad9900 t0 : 0000000000000000 [ 25.699401] t1 : fffffffffffffff0 t2 : ffffaf8001ad9a10 s0 : ffff8f8000203e30 [ 25.704912] s1 : ffffaf80018dc780 a0 : 0000000000000000 a1 : 0000000000000002 [ 25.710407] a2 : 00000000000001f0 a3 : 0000000000000018 a4 : 0000000000000000 [ 25.715917] a5 : 0000000000000000 a6 : ffffaf8001c03d98 a7 : ffffaf8001c03e30 [ 25.721419] s2 : ffff8f8000023c98 s3 : ffffaf8001aa1240 s4 : ffffffff80a04ee0 [ 25.726937] s5 : 0000000000000000 s6 : 0000000000000000 s7 : 0000000000000000 [ 25.732450] s8 : 0000000000000000 s9 : 0000000000000000 s10: 0000000000000000 [ 25.737944] s11: 0000000000000000 t3 : 0000000000000002 t4 : 0000000000000402 [ 25.743481] t5 : 0000000000000040 t6 : 0000000000000004 ssp : 0000000000000000 [ 25.749024] status: 0000000200000120 badaddr: ffffffff80a04ef8 cause: 000000000000000c [ 25.755060] [<ffffffff80a04ef8>] vec_check_unaligned_access_speed_all_cpus+0x18/0x2c [ 25.760964] [<ffffffff80047a10>] kthread+0xd8/0xfc [ 25.764660] [<ffffffff80010c48>] ret_from_fork_kernel+0x18/0x1c4 [ 25.769220] [<ffffffff80895fe6>] ret_from_fork_kernel_asm+0x16/0x18 [ 25.774018] Code: cccc cccc cccc cccc cccc cccc cccc cccc cccc cccc (cccc) cccc Drop __init from its signature so that this doesn't happen. Fixes: a00e022be531 ("riscv: Annotate unaligned access init functions") Signed-off-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Assisted-by: Claude:claude-opus-4-6 Link: https://patch.msgid.link/20260612-vec_unaligned_drop_init-v1-1-df969210ae34@oss.tenstorrent.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
11 daysdrm/msm: Fixup invalid overflow checkRob Clark
On overflow struct_size() would return SIZE_MAX. But kzalloc() (and friends) check this already, so we can just remove the check. On the other hand, we should be using the overflow helpers to calculate the cmd array size. Reported-by: Sashiko <sashiko-bot@kernel.org> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/743111/ Message-ID: <20260729155609.20190-18-robin.clark@oss.qualcomm.com>
11 daysdrm/msm: Fix per-process-pgtables checkRob Clark
ctx->vm should not be inialized yet (or if it has, an error is returned immediately following this check), so this isn't a valid way to check for per-process-pgtable support. Instead just check if create_private_vm() is supported. Reported-by: Sashiko <sashiko-bot@kernel.org> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/743096/ Message-ID: <20260729155609.20190-17-robin.clark@oss.qualcomm.com>
11 daysdrm/msm: Don't fallback to shared VM for VM_BINDRob Clark
If the user wants a userspace managed VM (EN_VM_BIND) don't silently fall back to shared VM. Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/743110/ Message-ID: <20260729155609.20190-16-robin.clark@oss.qualcomm.com>
11 daysdrm/msm: Allow lazy VM creation to failRob Clark
In the next commit, we'll stop falling back to shared VM if private VM creation fails. This isn't expected to happen in practice, it would either require small memory allocations to fail, or missing support in arm-smmu-qcom for setting up per-process pgtable support (ie. missing patch during bringup). Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/743088/ Message-ID: <20260729155609.20190-15-robin.clark@oss.qualcomm.com>
11 daysdrm/msm/gem: Validate lazy VM in GEM_NEWRob Clark
Otherwise creating a _NO_SHARE BO before any BOs are mapped could cause a NPE. Reported-by: Sashiko <sashiko-bot@kernel.org> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/743104/ Message-ID: <20260729155609.20190-14-robin.clark@oss.qualcomm.com>
11 daysdrm/msm/gem: Set resv before exposing objRob Clark
Don't swap the resv object _after_ exposing the newly created obj in LRU or global objects list, as that creates a race condition where another thread could lock the object using the original (per-obj) resv, but then unlock after the resv is replaced. Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/743109/ Message-ID: <20260729155609.20190-13-robin.clark@oss.qualcomm.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-09 10:10:25 +0000