summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-07-16scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR contextCan Guo
TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In that context, functions ufshcd_tx_eqtr(), __ufshcd_tx_eqtr() and ufs_qcom_get_rx_fom() allocate memory with GFP_KERNEL. If direct reclaim is triggered, reclaim/writeback can depend on I/O to UFS device. Because the queue is quiesced, this can cause deadlock. Use memalloc_noio_save/restore() in ufshcd_tx_eqtr() to cover all allocations in the TX EQTR call tree, including: - params->eqtr_record in ufshcd_tx_eqtr() - eqtr_data in __ufshcd_tx_eqtr() - params in ufs_qcom_get_rx_fom() This is preferred over tagging individual call sites with GFP_NOIO, as it automatically covers any future allocations added anywhere in the call tree without requiring each caller to be aware of this constraint. [mkp: fix label as suggested by Bart] Fixes: 03e5d38e2f98 ("scsi: ufs: core: Add support for TX Equalization") Closes: https://sashiko.dev/#/patchset/20260615132834.2985346-1-can.guo@oss.qualcomm.com?part=2 Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260618140941.902000-1-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16Merge patch series "scsi: ufs: Add support for static TX Equalization settings"Martin K. Petersen
Can Guo <can.guo@oss.qualcomm.com> says: Hi, This series adds support for board-specific static TX Equalization settings provided through Device Tree. This series is based on the earlier TX Equalization enablement work and persistent storage/retrieval of optimal TX Equalization settings work: https://lore.kernel.org/all/20260325152154.1604082-1-can.guo@oss.qualcomm.com https://lore.kernel.org/all/20260424151420.111675-1-can.guo@oss.qualcomm.com Background ========== UFS v5.0/UFSHCI v5.0 adds HS-G6 support (46.6 Gbps/lane) via UniPro v3.0 and M-PHY v6.0. These specs define TX Equalization for all High-Speed Gears (not only HS-G6) to compensate channel loss and improve signal integrity at high speed. For HS-G6, M-PHY uses PAM4 1b1b line coding. Pre-Coding may also be required depending on channel characteristics. This series adds vendor-neutral DT properties: - patternProperties: txeq-preshoot-g[1-6], txeq-deemphasis-g[1-6] - fixed property: tx-precode-enable-g6 All properties use per-lane Host/Device tuples and accept 2 or 4 values for x1/x2 lane configurations: - txeq-preshoot-g[1-6]: values 0..7 - txeq-deemphasis-g[1-6]: values 0..7 - tx-precode-enable-g6: values 0/1 These properties carry board-level SI characterization data used as static TX Equalization settings for each High-Speed Gear. Example DTS snippet =================== The following x2-lane example shows the expected DT encoding: ufs@1d84000 { lanes-per-direction = <2>; txeq-preshoot-g6 = <1 2>, <3 4>; txeq-deemphasis-g6 = <0 1>, <2 3>; tx-precode-enable-g6 = <1 0>, <0 1>; }; Relationship with Adaptive TX Equalization ========================================== Adaptive TX Equalization remains the primary path when enabled. Static TX Equalization settings from DT are board-specific baseline values, but when adaptive TX Equalization is used, static settings are not final: - If valid settings are retrieved from qTxEQGnSettings/wTxEQGnSettingsExt, those retrieved settings override static DT settings. - If retrieval is not available/valid, TX EQTR runs and trained settings override static DT settings. So static DT settings are a fallback and are intended for cases where adaptive TX Equalization is not enabled/used. No behavior changes for platforms that do not provide these properties. What this series adds ===================== 1. dt-bindings: - Document txeq-preshoot-g[1-6], txeq-deemphasis-g[1-6], and tx-precode-enable-g6 in ufs-common.yaml. - Define tuple encoding for host/device values per lane. - Add per-property value validation ranges in schema. 2. UFS core/platform integration: - Parse and validate per-gear DT TX EQ settings during platform init. - Store parsed values into per-gear TX EQ params and track DT origin using the from_dt flag. - Integrate static-state handling in TX EQ flow so DT-provided entries are fed through the adaptive TX Equalization path and then converted to normal runtime params. Link: https://patch.msgid.link/20260616113348.1168248-1-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16scsi: ufs: sysfs: Add HS_GEAR6 string in power_info/gear sysfs outputHimanshu Batra
In power_info/gear sysfs, currently it supports output only till gear 5. If operating mode is gear 6, it outputs "UNKNOWN". Add support for HS_GEAR6 string in sysfs output when operating mode is gear 6. Signed-off-by: Himanshu Batra <himanshubatra@google.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260616100121.548759-1-himanshubatra@google.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16drm/xe/multi_queue: Reject PXP usage on multi-queue exec queuesJagmeet Randhawa
HWDRM is currently the only supported PXP type, and it is display related, so it cannot be combined with multi-queue exec queue groups. Reject exec queue creation that requests both multi-queue and PXP, returning -EINVAL. The secondary queue path already rejects any PXP property, so this adds the missing check for the multi-queue primary, which would otherwise allow the combination. Validated with igt@xe_exec_multi_queue@sanity, which exercises both the PXP-unsupported (-ENODEV) and PXP-supported (-EINVAL) paths. v3: - Change commit title prefix to drm/xe/multi_queue:. - Add Niranjana's Reviewed-by. v2: - Move the multi-queue + PXP check to exec_queue_user_ext_check() to bail out early, keyed off the properties bitmask (Niranjana). Signed-off-by: Jagmeet Randhawa <jagmeet.randhawa@intel.com> Reviewed-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Signed-off-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Link: https://patch.msgid.link/4d369249d52384bc93663055a3757a50614ebbfd.1784238312.git.jagmeet.randhawa@intel.com
2026-07-17Merge tag 'drm-intel-gt-next-2026-07-16' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-next Driver Changes: Fixes/improvements/new stuff: - Fix phys BO pread/pwrite with offset [gem] (Joonas Lahtinen) - Add missing nospec on parallel submit slot [gem] (Joonas Lahtinen) - Return NULL on error in active_instance (Joonas Lahtinen) - Fix NULL deref in I915_CONTEXT_PARAM_SSEU [gem] (Joonas Lahtinen) - Fix NULL deref on sched_engine alloc failure [gt] (Joonas Lahtinen) - Do not leak siblings[] on proto context error [gem] (Joonas Lahtinen) Miscellaneous: - Return bool values from a boolean helper [gt] (Andi Shyti) - Use correct selftest config symbol [gt] (Pengpeng Hou) - Fix GT PM sort comparators [selftests] (Emre Cecanpunar) - Return NULL for missing multi-lrc parent [guc] (Linmao Li) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Tvrtko Ursulin <tursulin@igalia.com> Link: https://patch.msgid.link/aliZXnfbOV-Mh8gZ@linux
2026-07-17Merge tag 'drm-misc-next-2026-07-16' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for 7.3: UAPI Changes: Cross-subsystem Changes: Core Changes: - blend: allow blend mode property without PREMULTI - bridges: - Rename drm_for_each_bridge_in_chain_scoped to drm_for_each_bridge_in_chain - Drop legacy bridges support - gpusvm: Code reorganization to give drivers more flexibility Driver Changes: - etnaviv: Check if a reset has been successful - nouveau: Create instmem iomapping at first use - panthor: Remove redundant cleanup - qxl: Convert to a simple encoder to a regular one - bridges: - Convert all remaining legacy bridges to atomic - tc358767: clamp the reported AUX read size to the request - panels: - novatek-nt37801: Use mipi_dsi_*_multi() functions - samsung-s6d16d0: Fix prepare error handling Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@redhat.com> Link: https://patch.msgid.link/20260716-famous-pastel-ostrich-a1aaef@houat
2026-07-16drm/radeon: Only define radeon_acpi_vfct_match when actually usedUwe Kleine-König
This fixes the build failure drivers/gpu/drm/radeon/radeon_bios.c:614:12: error: ‘radeon_acpi_vfct_match’ defined but not used [-Werror=unused-function] 614 | static int radeon_acpi_vfct_match(struct radeon_device *rdev, | ^~~~~~~~~~~~~~~~~~~~~~ for builds with CONFIG_ACPI unset. Fixes: 4059e2f02c8a ("drm/radeon: Fix VFCT bus number matching with soft filter") Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu: dont pin wptr bo instead use eviction fenceSunil Khatri
Instead of pinning the wptr bo attach the eviction fence to the bo to make sure it remains valid all the time. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdkfd: Add bounds check for CRAT subtype lengthWilliam Palacek
The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures. Add validation that sub_type_hdr + length does not exceed the image boundary before parsing the subtype contents. Signed-off-by: William Palacek <William.Palacek@amd.com> Reviewed-by: Alysa Liu <Alysa.Liu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu: Use just sriov capability bit for xgmi ext peer link supportWill Aitken
The legacy xgmi ta without EXTEND_PEER_LINKS support in sriov still reports it as enabled. It then fails when the command is called. Rely on the host capability bit instead. v2: Replace other instances of supports_ext_link_info with this method. Including sysfs emission for xgmi_port_num. Now amd-smi xgmi --metric will output N/A for all cells when port_nums cannot be mapped in sriov Signed-off-by: Will Aitken <will.aitken@amd.com> Signed-off-by: Victor Skvortsov <victor.skvortsov@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdkfd: Clean up debug runlist printingKent Russell
Having single lines with random hex codes really doesn't help a user to know what's going on. Give it a title, and print 8 8-length hex values per line, instead of a single 2-length hex value per printed line. Previous output: ... amdgpu: 0x20000010 amdgpu: 0x3000 amdgpu: 0x12E6E00 amdgpu: 0xFF amdgpu: 0x207008 amdgpu: 0x 0 amdgpu: New output: amdgpu: Runlist dump: amdgpu: 0: 0xc00ea100 0x14008008 0x0f4fffc0 0x00000000 0x20002000 0x00000338 0x00000020 0x00080017 amdgpu: 8: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x03400000 0x00000000 0x00000000 amdgpu: 16: 0xc005a200 0x20000010 0x00003030 0x012ed000 0x000000ff 0x00252008 0x00000000 0xc005a200 amdgpu: 24: 0x20000010 0x0000302c 0x012ec800 0x000000ff 0x0024c008 0x00000000 0xc005a200 0x20000010 amdgpu: 32: 0x00003028 0x012ec000 0x000000ff 0x00246008 0x00000000 0xc005a200 0x20000010 0x00003024 amdgpu: 40: 0x012eb800 0x000000ff 0x00240008 0x00000000 0xc005a200 0x20000010 0x00003020 0x012eb000 amdgpu: 48: 0x000000ff 0x0023a008 0x00000000 0xc005a200 0x20000010 0x0000301c 0x012ea800 0x000000ff amdgpu: 56: 0x00234008 0x00000000 0xc005a200 0x20000010 0x00003018 0x012ea000 0x000000ff 0x0022e008 amdgpu: 64: 0x00000000 0xc005a200 0x20000010 0x00003014 0x012e9800 0x000000ff 0x00228008 0x00000000 amdgpu: 72: 0xc005a200 0x20000010 0x00003010 0x012e9000 0x000000ff 0x00222008 0x00000000 0xc005a200 amdgpu: 80: 0x20000010 0x0000300c 0x012e8800 0x000000ff 0x0021c008 0x00000000 0xc005a200 0x20000010 amdgpu: 88: 0x00003008 0x012e8000 0x000000ff 0x00216008 0x00000000 0xc005a200 0x20000010 0x00003004 amdgpu: 96: 0x012e7800 0x000000ff 0x00210008 0x00000000 0xc005a200 0x20000010 0x00003000 0x012e6e00 amdgpu: 104: 0x000000ff 0x00207008 0x00000000 Signed-off-by: Kent Russell <kent.russell@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu: use correct gfp_t for job allocationChristian König
For job allocation in GPU reset and page fault handling we must use GFP_ATOMIC to guarantee that we don't cycle back and depend on a dma_fence submission for the memory allocation. Add gfp_flags argument to amdgpu_job_alloc() and expose the gfp_flags of IB pools with amdgpu_ib_pool_gfp_flags() so that we can use different flags when allocating jobs. Assisted-by: Claude:Sonnet 4 Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu: move job parameter to the end in amdgpu_job_alloc() and *_with_ib()Christian König
Move the job output parameter to be the last parameter in the amdgpu_job_alloc() and amdgpu_job_alloc_with_ib() function signature. This aligns with the common kernel coding convention where output parameters typically come last. Assisted-by: Claude:Sonnet 4 Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu: add gfp_flags to amdgpu_sa_manager v2Christian König
Make sure that we use the emmergency reserves for unrecoverable page faults and GPU resets. v2: improve code comments a bit based on Timur's feedback Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu: give different sizes for each SA pool typeChristian König
The IMMEDIATE (page fault) and DIRECT (reset) pool should be used only very rarely and by a single thread. Saves roughly 1.25MiB of memory and GART space for each amdgpu device. Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu: properly account for resets with user queuesAlex Deucher
We need to increment the reset counter, force fence completion, and set the wedged event when a user queue is reset, but only for the guilty queue. We don't want additional events for collateral damage. Only increment the reset counter and set the wedged event in the top level userq reset callers (both KGD and KFD). This aligns with how this is managed for kernel queue resets. v2: fix task info refcount handling, align with kfd error reporting. v3: check for has_reset_queue in KFD path (Prike) Cc: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Cc: Prike Liang <Prike.Liang@amd.com> Cc: Sunil Khatri <sunil.khatri@amd.com> Cc: Lazar, Lijo <lijo.lazar@amd.com> Reviewed-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Prike Liang <Prike.Liang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu/gfx9.4.3: Fix MEC rollback loop in EOP IRQ setupSrinivasan Shanmugam
Fix the error cleanup path in gfx_v9_4_3_set_userq_eop_interrupts() by using the correct loop condition. This ensures all previously enabled EOP IRQs are released if setup fails. Fixes: 832f0aa050ff ("drm/amdgpu/gfx9.4.3: add support for disabling kernel queues") Reported-by: Dan Carpenter <error27@gmail.com> Cc: Kent Russell <kent.russell@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu : update mmhub eco sec lvl for vcn5_3Suresh Guttula
This patch requests PSP to set the sec lvl for vcn and jpeg. Signed-off-by: Suresh Guttula <suresh.guttula@amd.com> Reviewed-by: McRae Geoffrey<Geoffrey.McRae@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/msm: Only fini scheduler after successful initRuoyu Wang
msm_ringbuffer_new() destroys a partially initialized ring through msm_ringbuffer_destroy() when an allocation or scheduler setup step fails. If drm_sched_init() fails before it finishes initializing the scheduler, the failure path still calls drm_sched_fini(). That teardown path assumes the scheduler work items, lists, and workqueue state were initialized. Track successful scheduler initialization and call drm_sched_fini() only after drm_sched_init() returned 0. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 1d8a5ca436ee ("drm/msm: Conversion to drm scheduler") Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Patchwork: https://patchwork.freedesktop.org/patch/738905/ Message-ID: <20260709062309.4168362-1-ruoyuw560@gmail.com> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-07-16drm/msm: Fix task_struct reference leak in recover_workerJie Zhang
get_pid_task() increments the task reference count, but the corresponding put_task_struct() was missing in the else branch, leaking a reference on every GPU hang recovery. Fixes: 25654a1756a4 ("drm/msm: Update global fault counter when faulty process has already ended") Signed-off-by: Jie Zhang <jie.zhang@oss.qualcomm.com> Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/730662/ Message-ID: <20260605-assorted-fixes-june-v1-6-2caa04f7287c@oss.qualcomm.com> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-07-16drm/msm/a6xx: Fix IRQ storm during msm_recovery testJie Zhang
Once a hang is triggered by the msm_recovery test, the gpu error irq remains asserted and triggers an interrupt storm. In the worst case, this IRQ storm lands on the CPU core where the hangcheck timer is scheduled, blocking it from running. This eventually leads to CPU watchdog timeouts. To fix this, mask the gpu error irqs during msm_recovery test and enable them back during the recovery. Fixes: 5edf2750d998 ("drm/msm: Add debugfs to disable hw err handling") Signed-off-by: Jie Zhang <jie.zhang@oss.qualcomm.com> Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/730660/ Message-ID: <20260605-assorted-fixes-june-v1-5-2caa04f7287c@oss.qualcomm.com> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-07-16drm/msm/a6xx: Fix A621 GPUCC register list for state captureJie Zhang
A621 uses an incorrect GPUCC register list during state capture. The existing list matches A623/A663. Rename it accordingly and add a dedicated A621 GPUCC register list. Fixes: 11cdb81b3c1b ("drm/msm/a6xx: Fix gpucc register block for A621") Signed-off-by: Jie Zhang <jie.zhang@oss.qualcomm.com> Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/730659/ Message-ID: <20260605-assorted-fixes-june-v1-4-2caa04f7287c@oss.qualcomm.com> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-07-16drm/msm/a6xx: Fix A663 GPUCC register list for state captureJie Zhang
The GPUCC register list for A663 is incorrect, which can cause out-of-bounds register access during GPU state capture. Update it to use the correct register ranges. Fixes: 5773cce8615c ("drm/msm/a6xx: Add support for A663") Signed-off-by: Jie Zhang <jie.zhang@oss.qualcomm.com> Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/730656/ Message-ID: <20260605-assorted-fixes-june-v1-3-2caa04f7287c@oss.qualcomm.com> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-07-16drm/msm: Recover HW before retire hung submitJie Zhang
During recovery, it is not safe to retire the hung submit before we recover the GPU. Retiring the submit triggers BO free and that can result in GPU pagefaults since the GPU may be actively accessing those BOs. To fix this, retire the submits after gpu recovery is complete in recover_worker(). Fixes: 1a370be9ac51 ("drm/msm: restart queued submits after hang") Signed-off-by: Jie Zhang <jie.zhang@oss.qualcomm.com> Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com> Acked-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/730655/ Message-ID: <20260605-assorted-fixes-june-v1-2-2caa04f7287c@oss.qualcomm.com> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-07-16drm/msm/a6xx: Fix stale rpmh votes after suspendShivam Rawat
There are stale RPMH votes (BCM votes) observed after GMU suspend. This is because the rpmh stop sequences are skipped during gmu suspend. Fix this and also move GMU to reset state to avoid any further activity. Fixes: f248d5d5159a ("drm/msm/a6xx: Fix PDC sleep sequence") Signed-off-by: Shivam Rawat <shivrawa@qti.qualcomm.com> Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com> Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/730652/ Message-ID: <20260605-assorted-fixes-june-v1-1-2caa04f7287c@oss.qualcomm.com> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-07-16drm/msm/a3xx: Drain VBIF before GPU suspendAlexandre MINETTE
A3xx hangs after every runtime suspend on the Samsung Galaxy S4 GT-I9505. Even simple GPU workloads, such as drawing a single triangle, hang reliably once the GPU has been suspended by runtime PM. The generic MSM GPU suspend path disables clocks/power, but A3xx also needs to ensure that pending VBIF transactions are drained before that happens. Add an A3xx-specific pm_suspend callback. Wait for the GPU to become idle, halt all VBIF XIN clients, wait for the corresponding acknowledgment, and only then enter the generic MSM GPU suspend path. This fixes reliable A3xx GPU hangs observed after runtime PM on the Samsung Galaxy S4 GT-I9505, codename jflte. The failure is reported as: mdp4 5100000.display-controller: [drm:hangcheck_handler] *ERROR* 3.2.0.2: hangcheck detected gpu lockup rb 0! mdp4 5100000.display-controller: [drm:hangcheck_handler] *ERROR* 3.2.0.2: completed fence: 4294967041 mdp4 5100000.display-controller: [drm:hangcheck_handler] *ERROR* 3.2.0.2: submitted fence: 4294967049 mdp4 5100000.display-controller: [drm:recover_worker] *ERROR* 3.2.0.2: hangcheck recover! Link: https://github.com/freedreno-zz/freedreno/issues/12 Signed-off-by: Alexandre MINETTE <contact@alex-min.fr> Patchwork: https://patchwork.freedesktop.org/patch/731919/ Message-ID: <20260610-mainline-fix-a3xx-gpu-hang-sending-v1-1-9282182840b5@alex-min.fr> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-07-16drm/msm/adreno: fix use after free on error path in a6xx_gpu_init()Dan Carpenter
The a6xx_destroy() function frees "a6xx_gpu" and so "adreno_gpu" points to freed memory. Preserve the error code before freeing the memory to avoid a use after free. Fixes: d158886cba08 ("drm/msm/adreno: Trust the SSoT UBWC config") Signed-off-by: Dan Carpenter <error27@gmail.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/732275/ Message-ID: <aiqNktNfXiaPhje3@stanley.mountain> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-07-16drm/tegra: vic: Add Tegra264 supportMikko Perttunen
Add support for VIC on Tegra264. The Tegra264 VIC uses a RISC-V based Falcon microcontroller instead of the traditional Falcon previously, and has the TRANSCFG register in a different place. The .version field is set to 0x264 rather than 0x26 to allow distinguishing between different VIC capabilities between minor version variations of some chips. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> [treding@nvidia.com: fix checkpatch warnings] Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260622-t264-host1x-v2-6-ff7364d9ff7b@nvidia.com
2026-07-16PCI: spacemit: Add missing MODULE_DEVICE_TABLE()Pengpeng Hou
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260704122538.92830-1-pengpeng@iscas.ac.cn
2026-07-16Input: snvs_pwrkey - use local device pointer to simple codeJoy Zou
Use local struct device pointer to avoid reference the platform_device pointer every time. No functional change. Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Joy Zou <joy.zou@nxp.com> Link: https://patch.msgid.link/20260715-b4-pwrkey-v5-3-07e7353c319e@oss.nxp.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-16Input: snvs_pwrkey - propagate error code of platform_get_irq()Joy Zou
Hardcoding -EINVAL discards the actual error code, which breaks probe deferral (-EPROBE_DEFER) and loses critical diagnostic information needed for proper kernel error handling. Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Joy Zou <joy.zou@nxp.com> Link: https://patch.msgid.link/20260715-b4-pwrkey-v5-2-07e7353c319e@oss.nxp.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-16Input: snvs_pwrkey - make use of dev_err_probe()Joy Zou
Add dev_err_probe() at return path of probe() to support users to identify issues easier. Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Joy Zou <joy.zou@nxp.com> Link: https://patch.msgid.link/20260715-b4-pwrkey-v5-1-07e7353c319e@oss.nxp.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-16drm/tegra: falcon: Add support for RISC-V external bootMikko Perttunen
Add support for loading and booting RISC-V firmwares on Falcons with RISC-V hardware. The flow is mostly the same as for traditional Falcons, with a few different registers and different firmware layout. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260622-t264-host1x-v2-5-ff7364d9ff7b@nvidia.com
2026-07-16gpu: host1x: Add Tegra264 supportSantosh BS
Add device data and chip headers for Tegra264. Signed-off-by: Santosh BS <santoshb@nvidia.com> Co-developed-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260622-t264-host1x-v2-4-ff7364d9ff7b@nvidia.com
2026-07-16gpu: host1x: Correctly parse linear ranges of context devicesMikko Perttunen
The previous parsing of the iommu-map property assumed each context device has its own one-length entry in the device tree. This has worked fine so far, but on Tegra264 larger numbers of context devices are usable, so it's better to support linear ranges as well. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260622-t264-host1x-v2-3-ff7364d9ff7b@nvidia.com
2026-07-16gpu: host1x: Annotate intentional syncpoint wrap-aroundMikko Perttunen
Host1x syncpoints are 32-bit counters that roll over by design. To make that explicit in the code, use wrapping_* functions whenever arithmetic is done on syncpoint values. Atomic operations cannot be updated but a comment is added. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260609-b4-host1x-small-fixes-a-v1-6-7c1131c0b3ad@nvidia.com
2026-07-16gpu: host1x: Change pin_job() return type to intMikko Perttunen
pin_job() returns negative errno values on error paths (-EINVAL, -ENOMEM, PTR_ERR() of mapping) but was declared as unsigned int. The caller would immediately cast back to int, so there was no functional issue, but it still warrants fixing. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260609-b4-host1x-small-fixes-a-v1-5-7c1131c0b3ad@nvidia.com
2026-07-16gpu: host1x: Avoid stack over-read in debug output helpersMikko Perttunen
host1x_debug_output() and host1x_debug_cont() used vsnprintf(), which returns the length the formatted string would have reached with an unbounded buffer. That return value was passed straight to o->fn as the number of bytes to emit. This could cause a read past end of the output buffer if a call to host1x_debug_* produced a string longer than 256 bytes. This only affected the debugfs files as the printk debug sink ignores the number of bytes. In practice, this is very unlikely to occur. Fix by switching to vscnprintf(), which returns the number of bytes actually written. Fixes: 6236451d83a7 ("gpu: host1x: Add debug support") Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260609-b4-host1x-small-fixes-a-v1-4-7c1131c0b3ad@nvidia.com
2026-07-16gpu: host1x: Fix offset calculation in trace_write_gatherMikko Perttunen
When a gather longer than 2*TRACE_MAX_LENGTH (256) words is traced through host1x_cdma_push_gather, the reported BO offset drifts from the third iteration onward. Fix the calculation by properly calculating the value on each loop rather than accumulating. In reality, gathers tend to be pretty short so this is unlikely to ever have been observed. Fixes: b40d02bf96e0 ("gpu: host1x: Use struct host1x_bo pointers in traces") Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260609-b4-host1x-small-fixes-a-v1-3-7c1131c0b3ad@nvidia.com
2026-07-16gpu: host1x: Avoid double device_add when clients already presentMikko Perttunen
host1x_device_add looks through the idle clients list to populate subdevs, and any matches entries are moved from the subdevs list to the active list. If all subdevs are populated, device_add will be called on the device. The secondary "subdevs list empty" check will then incorrectly again call device_add. However, this would require a convoluted scenario since clients don't typically end up on the idle clients list. Fix by checking whether the device was already added before adding again. Fixes: fab823d82ee5 ("gpu: host1x: Allow loading tegra-drm without enabled engines") Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260609-b4-host1x-small-fixes-a-v1-2-7c1131c0b3ad@nvidia.com
2026-07-16gpu: host1x: Wait for timeout worker completion on channel freeMikko Perttunen
cdma_timeout_destroy() used cancel_delayed_work() to cancel pending timeout work when destroying the CDMA. Usually this is fine, but there is a narrow race condition where the timeout handler has started execution but has not taken cdma->lock; the channel is freed causing cdma_stop to take cdma->lock and flush the channel; host1x_cdma_deinit then proceeds with deinitializing cdma while the handler is waiting to take cdma->lock. Therefore change cdma_timeout_destroy to use cancel_delayed_work_sync instead to ensure any pending timeout work completes before proceeding. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260609-b4-host1x-small-fixes-a-v1-1-7c1131c0b3ad@nvidia.com
2026-07-16gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappingsMikko Perttunen
__host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead. Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/linux-tegra/ah6ErK6f4kVudVIA@stanley.mountain/T/#u Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260603-host1x-bocache-leak-fix-v1-1-494101dbfd30@nvidia.com
2026-07-16wifi: iwlwifi: adapt ND match notif sizing to fixed matches arrayEmmanuel Grumbach
Switch iwl_scan_offload_match_info::matches to a fixed-size array and adjust D3 netdetect size handling accordingly. In MVM D3 paths, compute expected payload size as offsetof(struct iwl_scan_offload_match_info, matches) + matches_len to preserve previous behavior after the struct layout change. In MLD D3 netdetect handling, keep the simple full-notification size assumption and validate against sizeof(*notif) before accessing data. This keeps scan offload / netdetect functionality unchanged while making length checks consistent with the new struct definition. Assisted-by: GitHubCopilot:gpt-5.3-codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715215523.4c4346140bcc.I44313ac41daca352e6aecdba09a1c3570c3eea06@changeid
2026-07-16wifi: iwlwifi: mvm: fix a possible underflowEmmanuel Grumbach
We shouldn't trust the firmware about the length of the wowlan packet. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715215523.fbd989cc85e2.If68de403bfa4943732c025961154c20b01b09e83@changeid
2026-07-16wifi: iwlwifi: mvm: copy the correct TK length for rangingAvraham Stern
When setting the TK for ranging with an associated peer, 32 bytes of TK are copied from the vif key without verifying the actual key length which may be only 16 bytes if CCMP-128 is used. Fix it by setting the copy length according to the key cipher. Signed-off-by: Avraham Stern <avraham.stern@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715215523.e339570086bd.Iafff5aaf0e25f7d29e06f0ef456107c4062bbc7d@changeid
2026-07-16wifi: iwlwifi: mvm: add a check on the tid coming from the firmwareEmmanuel Grumbach
ba_notif->tid is a firmware-controlled u8 that is used directly as an array index into tid_data[] without any validation. Add a bounds check against IWL_MAX_TID_COUNT before dereferencing the array. Assisted-by: GitHubCopilot:gpt-5.3-codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715215523.d7c3e75d47af.If88948108cfc8b5fb3ce5531d927855d1b3b6b30@changeid
2026-07-16wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notifEmmanuel Grumbach
mvmsta->tid_data was indexed by the TFD loop counter 'i' instead of the actual TID value 'tid'. This writes lq_color into a random tid_data slot unrelated to the BA entry. Since multi-TID blockack is not really in use, 'i' was always 0 and no harm was done. Add a out-of-bound check before accessing the array. Assisted-by: GitHubCopilot:gpt-5.3-codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715215523.919edee567eb.Ie85c350e3afe2b39709d0039072740d86660f8ae@changeid
2026-07-16wifi: iwlwifi: pcie: validate FW section counts in iwl_pcie_init_fw_secEmmanuel Grumbach
iwl_pcie_init_fw_sec() iterates over LMAC, UMAC, and paging firmware sections and writes to ctxt_dram->lmac_img[i], ctxt_dram->umac_img[i], and ctxt_dram->virtual_img[i] without first verifying that the counts derived from the firmware image do not exceed the array size. An oversized firmware image could cause out-of-bounds writes into the fixed-size context-info DRAM arrays. Add explicit WARN_ON checks for all three section counts and return -EINVAL if any is exceeded. Assisted-by: GitHubCopilot:gpt-5.3-codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715215523.34db46ca12f3.I1aa225492a62f25293c147aa7293afa80a5d4215@changeid
2026-07-16wifi: iwlwifi: mvm: ptp: free response on success pathEmmanuel Grumbach
Release CMD_WANT_SKB response buffer after successful timestamp parsing to avoid leaking response allocations. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715215523.31b38bef398b.Ib6a5a8bdd800779c8911da6859fd450d3d19c9e9@changeid
2026-07-16wifi: iwlwifi: mvm: fix read in wake packet notification handlerShahar Tzarfati
In iwl_mvm_wowlan_store_wake_pkt(), packet_len was initialized from notif->wake_packet_length before the explicit check that len >= sizeof(*notif). Move the assignment of packet_len to after the size check so that notif->wake_packet_length is only accessed once the payload length has been validated. Fixes: 219ed58feda9 ("wifi: iwlwifi: mvm: Add support for wowlan wake packet notification") Signed-off-by: Shahar Tzarfati <shahar.tzarfati@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715215523.99d5cf85a528.Ic4aa736011d4fe88e0cd19723d1d48bb24642198@changeid
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-08 08:09:08 +0000