summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-08-26gpio: generic: Avoid pinctrl calls when ranges are missingLinus Walleij
Most calls to the pinctrl core is done through the generic helper that go into gpiolib, where the library checks if there is a range associated with the chip and just bails out silently if ther isn't. gpio_mmio_dir_return() misses this check before calling pinctrl_gpio_direction_output/input(). Fix this up with an explicit range check. Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/linux-devicetree/20260820073920.909F71F000E9@smtp.kernel.org/ Signed-off-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260820-fix-gpio-mmio-pinctrl-v1-1-62c2d7dd4903@kernel.org Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-08-26gpio: gpiolib-kunit: use devm_blocking_notifier_chain_register()Eliav Farber
Replace the blocking_notifier_chain_register() + devm_add_action_or_reset() pattern with a single call to devm_blocking_notifier_chain_register(), removing the gpio_unbind_unregister_notifier() callback. Signed-off-by: Eliav Farber <farbere@amazon.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260816060648.4030-13-farbere@amazon.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-08-26gpio: eic-sprd: use devm_atomic_notifier_chain_register()Eliav Farber
Replace the atomic_notifier_chain_register() + devm_add_action_or_reset() pattern with a single call to devm_atomic_notifier_chain_register(), removing the sprd_eic_unregister_notifier() callback. Signed-off-by: Eliav Farber <farbere@amazon.com> Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260816060648.4030-12-farbere@amazon.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-08-26gpio: adp5585: use devm_blocking_notifier_chain_register()Eliav Farber
Replace the blocking_notifier_chain_register() + devm_add_action_or_reset() pattern with a single call to devm_blocking_notifier_chain_register(), removing the adp5585_gpio_unreg_notifier() callback. Signed-off-by: Eliav Farber <farbere@amazon.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260816060648.4030-6-farbere@amazon.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-08-26of/irq: Fix device node refcount leak in of_irq_get_affinity()Fuad Tabba
of_irq_parse_one() raises the refcount of the interrupt controller node on success, and of_irq_get_affinity() returns without putting it, so every call past the parse leaks one reference. It is reached from platform_get_irq_affinity(), used by arm_pmu, arm_spe_pmu and coresight-trbe. Put it once irq_populate_fwspec_info() has run: no in-tree ->get_fwspec_info() returns a mask that lives in the node. Fixes: 5404f5c06dd4 ("of/irq: Add interrupt affinity reporting interface") Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20260826112234.1033974-1-fuad.tabba@linux.dev Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-08-26i2c: mux: Fix channel node leak on adapter add failureAhmad Byagowi
i2c_mux_add_adapter() takes a reference to the Device Tree channel node before registering the new adapter. If adapter registration fails, the error path frees the private data without dropping that reference. Release the channel node before freeing the private data. Fixes: bc45449b1444 ("i2c/of: Automatically populate i2c mux busses from device tree data.") Signed-off-by: Ahmad Byagowi <ahmadexp@gmail.com> Cc: <stable@vger.kernel.org> # v3.5+ Acked-by: Peter Rosin <peda@lysator.liu.se> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://patch.msgid.link/b3e46bbee781b3cb4029aca9a71316cc5e36dc17.1787502619.git.ahmadexp@gmail.com
2026-08-26Input: adp5588-keys - cache GPIO state before registering the gpiochipAlvin Šipraga
So as not to clobber any pre-programmed GPIO state in the execution of its gpiochip ops, the driver caches things during probe time. However, since those ops can be called both during and immediately after the call to devm_gpiochip_add_data(), it is imperative that things are cached before that. That's not the case right now, so reorder the two steps to prevent any clobbering. In the concrete example which motivated this change, a bootloader was preconfiguring an important GPIO output to HIGH before booting the kernel. Linux would then inadvertently set that output to LOW while configuring a GPIO hog on a discrete GPIO line within the same 8-bit bank (because the cached value was 0=LOW). Fixes: ba9f507a1bea ("Input: adp5588-keys - export unused GPIO pins") Signed-off-by: Alvin Šipraga <alvin.sipraga@analog.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Link: https://patch.msgid.link/20260818-adp5588-gpio-cache-v1-1-650a2674fc0d@analog.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-26drm/xe/sysctrl: Read mailbox phase bit from hardwareAnoop Vijay
The mailbox PHASE bit in SYSCTRL_MB_CTRL is toggled per-message and was tracked in software as sc->phase_bit, reset to 0 on error paths. If the cached value ever drifts from what the hardware last saw, all following messages carry the wrong phase and get silently misread by firmware. Drop the cache and read PHASE directly from SYSCTRL_MB_CTRL before each frame instead, removing xe_sysctrl_mailbox_init() and its call sites along with it. Fixes: 1f95f618182b ("drm/xe/xe_sysctrl: Add System Controller mailbox communication support") Signed-off-by: Anoop Vijay <anoop.c.vijay@intel.com> Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/20260825172827.3801591-2-anoop.c.vijay@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-08-26gpio: pcf857x: implement get_direction()Tapio Reijonen
The GPIO core warns (and taints the kernel) when a gpiochip lacks .get_direction() and a consumer queries a line's direction, for example via /sys/kernel/debug/gpio. pcf857x provided direction_input/output but no get_direction. These quasi-bidirectional expanders cannot report direction in hardware, and the 'out' software latch alone is ambiguous - a released (input) line and an output driven high both read back as a set bit. Track the direction explicitly in a 'dir' latch updated by the direction_input(), direction_output() and set_multiple() paths, and return it from get_direction(). Initialise it from the same reset state as 'out': released lines are inputs, lines flagged in the power-on latch are driven-low outputs. Fixes: 15fae37d9f5f ("gpiolib: pcf857x i2c gpio expander support") Signed-off-by: Tapio Reijonen <tapio.reijonen@vaisala.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260825-b4-gpio-pcf857x-get-direction-v1-1-de15996ae354@vaisala.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-08-26drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is usedThadeu Lima de Souza Cascardo
Commit 1c6ceeee6ebb ("drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits") fixed a very similar issue when the event was allocated by drm_atomic_helper_setup_commit() itself. However, if the event is allocated in prepare_signaling(), it will also be set to NULL in complete_signaling(), which prevents drm_crtc_commit from being put in __drm_atomic_helper_crtc_destroy_state(). Dropping the reference when the event is set to NULL at complete_signaling() fixes the leak. The leak can be reproduced by sending a signal to the thread using DRM_MODE_PAGE_FLIP_EVENT and using a sw_sync fence to cause the atomic ioctl to block at drm_atomic_helper_wait_for_fences(). It happened both with amdgpu and vkms. Fixes: 24835e442f28 ("drm: reference count event->completion") Cc: stable@vger.kernel.org Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Reviewed-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Link: https://patch.msgid.link/20260727-drm_crtc_atomic_commit_leak-v1-1-23d9948a9d7c@igalia.com
2026-08-26drm/atomic: remove bogus check for file_privThadeu Lima de Souza Cascardo
Since file_priv can never be NULL at prepare_signaling() as it is only called by drm_mode_atomic_ioctl(), remove the check. If that was not the case, skipping the rest of the block here would cause the drm_pending_vblank_event object to leak and fail to set up the fence in case out_fence_ptr is set. Since the check is unreachable, there is no possible leak. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Reviewed-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Link: https://patch.msgid.link/20260817-drm_atomic_bogus_check-v2-1-2b9e60f32a7e@igalia.com
2026-08-26power: sequencing: rename pwrseq_power_on/off() to pwrseq_enable/disable()Bartosz Golaszewski
The way power sequencing works means that a call to pwrseq_power_on() does not necessarily result in the pwrseq target being powered-on at that time: it may have already been powered on before. Similarly: a call to pwrseq_power_off() does not have to result in an actual powering off of resources: there may still be other users that requested a power-on before. We will also introduce the concept of "non-controllable" pwrseq targets soon which further increases the disconnect between the naming convention and the actual semantics. What consumers of pwrseq descriptors actually do is: they *vote* for a powering on of a given target or retract that vote. These operations could be called get/put in line with runtime PM but this could become confusing since we already provide pwrseq_get/put() for a different purpose. pwrseq_vote_on/off() also have been rejected as unusual in the tree. Change the name of the two functions to pwrseq_enable/disable() which better reflects their purpose and semantics and also mirrors other enable-counted resources like regulators and clocks. No functional change intended. If at any point users need to know *when* the exact power event happens, we can provide that information in the form of a notifier. Acked-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com> Acked-by: Bjorn Helgaas <bhelgaas@google.com> Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Acked-by: Alessio Belle <alessio.belle@imgtec.com> # imagination Link: https://patch.msgid.link/20260731-pwrseq-vote-rename-v3-1-44e60b8be053@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-08-26drm/meson: remove dependency on DRM simple helpersDiogo Silva
The simple KMS helpers are deprecated because they only add an intermediate layer between drivers and atomic modesetting. Open-code drm_simple_encoder_init() by calling drm_encoder_init() directly and providing driver-local drm_encoder_funcs. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260720-drm_simple_encoder_init-v2-13-5020b630668a@gmail.com
2026-08-26drm/arm/komeda: remove dependency on DRM simple helpersDiogo Silva
The simple KMS helpers are deprecated because they only add an intermediate layer between drivers and atomic modesetting. Open-code drm_simple_encoder_init() by calling drm_encoder_init() directly and providing driver-local drm_encoder_funcs. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260720-drm_simple_encoder_init-v2-12-5020b630668a@gmail.com
2026-08-26drm/hisilicon/kirin: remove dependency on DRM simple helpersDiogo Silva
The simple KMS helpers are deprecated because they only add an intermediate layer between drivers and atomic modesetting. Open-code drm_simple_encoder_init() by calling drm_encoder_init() directly and providing driver-local drm_encoder_funcs. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260720-drm_simple_encoder_init-v2-11-5020b630668a@gmail.com
2026-08-26drm/renesas/shmobile: remove dependency on DRM simple helpersDiogo Silva
The simple KMS helpers are deprecated because they only add an intermediate layer between drivers and atomic modesetting. Open-code drm_simple_encoder_init() by calling drm_encoder_init() directly and providing driver-local drm_encoder_funcs. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260720-drm_simple_encoder_init-v2-10-5020b630668a@gmail.com
2026-08-26drm/mediatek: remove dependency on DRM simple helpersDiogo Silva
The simple KMS helpers are deprecated because they only add an intermediate layer between drivers and atomic modesetting. Open-code drm_simple_encoder_init() by calling drm_encoder_init() directly and providing driver-local drm_encoder_funcs. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Reviewed-by: CK Hu <ck.hu@mediatek.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260720-drm_simple_encoder_init-v2-9-5020b630668a@gmail.com
2026-08-26drm/imx: remove dependency on DRM simple helpersDiogo Silva
The simple KMS helpers are deprecated because they only add an intermediate layer between drivers and atomic modesetting. Open-code drm_simple_encoder_init() by calling drm_encoder_init() directly and providing driver-local drm_encoder_funcs. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260720-drm_simple_encoder_init-v2-8-5020b630668a@gmail.com
2026-08-26drm/tidss: remove dependency on DRM simple helpersDiogo Silva
The simple KMS helpers are deprecated because they only add an intermediate layer between drivers and atomic modesetting. Open-code drm_simple_encoder_init() by calling drm_encoder_init() directly and providing driver-local drm_encoder_funcs. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260720-drm_simple_encoder_init-v2-7-5020b630668a@gmail.com
2026-08-26drm/virtio: remove dependency on DRM simple helpersDiogo Silva
The simple KMS helpers are deprecated because they only add an intermediate layer between drivers and atomic modesetting. Open-code drm_simple_encoder_init() by calling drm_encoder_init() directly and providing driver-local drm_encoder_funcs. Also check the return value from drm_encoder_init() to avoid silent failures. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260720-drm_simple_encoder_init-v2-6-5020b630668a@gmail.com
2026-08-26drm/kmb: remove dependency on DRM simple helpersDiogo Silva
The simple KMS helpers are deprecated because they only add an intermediate layer between drivers and atomic modesetting. Open-code drm_simple_encoder_init() by calling drm_encoder_init() directly and providing driver-local drm_encoder_funcs. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260720-drm_simple_encoder_init-v2-5-5020b630668a@gmail.com
2026-08-26drm/fsl-dcu: remove dependency on DRM simple helpersDiogo Silva
The simple KMS helpers are deprecated because they only add an intermediate layer between drivers and atomic modesetting. Open-code drm_simple_encoder_init() by calling drm_encoder_init() directly and providing driver-local drm_encoder_funcs. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260720-drm_simple_encoder_init-v2-4-5020b630668a@gmail.com
2026-08-26drm/tegra: remove dependency on DRM simple helpersDiogo Silva
The simple KMS helpers are deprecated because they only add an intermediate layer between drivers and atomic modesetting. Open-code drm_simple_encoder_init() by calling drm_encoder_init() directly and providing driver-local drm_encoder_funcs. Also check the return value from drm_encoder_init() to avoid silent failures. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260720-drm_simple_encoder_init-v2-3-5020b630668a@gmail.com
2026-08-26drm/xlnx/zynqmp_dpsub: remove dependency on DRM simple helpersDiogo Silva
The simple KMS helpers are deprecated because they only add an intermediate layer between drivers and atomic modesetting. Open-code drm_simple_encoder_init() by calling drm_encoder_init() directly and providing driver-local drm_encoder_funcs. Also check the return value from drm_encoder_init() to avoid silent failures. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260720-drm_simple_encoder_init-v2-2-5020b630668a@gmail.com
2026-08-26drm/exynos: remove dependency on DRM simple helpersDiogo Silva
The simple KMS helpers are deprecated because they only add an intermediate layer between drivers and atomic modesetting. Open-code drm_simple_encoder_init() by calling drm_encoder_init() directly and providing driver-local drm_encoder_funcs. Also check the return value from drm_encoder_init() to avoid silent failures. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260720-drm_simple_encoder_init-v2-1-5020b630668a@gmail.com
2026-08-26drm/cirrus-qemu: Validate BAR0 size during probeSlawomir Stepien
The `cirrus-qemu` driver relies on `CIRRUS_VRAM_SIZE` (4 MB) to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches `CIRRUS_VRAM_SIZE`. If a PCI device with a BAR0 smaller than 4 MB is bound to the driver, the mapped VRAM will be smaller than expected. Because validation checks assume 4 MB VRAM, framebuffers larger than the mapped memory can be created. When the display plane is updated (e.g. during release), `cirrus_primary_plane_helper_atomic_update()` copies the framebuffer to VRAM using `drm_fb_memcpy()`. Writing past the end of the mapped I/O memory causes a supervisor write page fault: BUG: unable to handle page fault for address: ffffc9000389c000 ... RIP: 0010:memcpy_toio+0x7c/0xe0 arch/x86/lib/iomem.c:110 ... Call Trace: <TASK> iosys_map_memcpy_to include/linux/iosys-map.h:285 [inline] drm_fb_memcpy+0x325/0x5d0 drivers/gpu/drm/drm_format_helper.c:442 cirrus_primary_plane_helper_atomic_update+0x98a/0xb00 drivers/gpu/drm/tiny/cirrus-qemu.c:358 drm_atomic_helper_commit_planes+0x626/0xea0 drivers/gpu/drm/drm_atomic_helper.c:3038 drm_atomic_helper_commit_tail+0x60/0x510 drivers/gpu/drm/drm_atomic_helper.c:1989 commit_tail+0x2b1/0x3c0 drivers/gpu/drm/drm_atomic_helper.c:2074 drm_atomic_helper_commit+0xa77/0xb10 drivers/gpu/drm/drm_atomic_helper.c:2312 Fix this by validating in `cirrus_pci_probe()` that the PCI BAR0 resource is not less than `CIRRUS_VRAM_SIZE`, returning `-ENODEV` if it is less. Fixes: ab3e023b1b4c ("drm/cirrus: rewrite and modernize driver.") Assisted-by: Gemini:gemini-3.6-flash Gemini:gemini-3.1-pro-preview syzbot Reported-by: syzbot+2442951a6abb004df963@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2442951a6abb004df963 Link: https://syzkaller.appspot.com/ai_job?id=ba262a3a-bccf-4ad8-a1b0-583c55d34fd6 Signed-off-by: Slawomir Stepien <sst@poczta.fm> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260825120729.493611-1-sst@poczta.fm
2026-08-26drm/sysfb: ofdrm: Fix is_avivo() constant comparison bugShixiong Ou
The is_avivo() function has a logic error where it compares a constant to another constant instead of checking the device parameter: (PCI_VENDOR_ID_ATI_R600 >= 0x9400) Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Fixes: f496834e1674 ("drm/ofdrm: Add per-model device function") Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Cc: <stable@vger.kernel.org> # v6.2+ Link: https://patch.msgid.link/20260731111729.703116-1-oushixiong1025@163.com
2026-08-26drm/sysfb: ofdrm: Fix integer overflow in fb_size calculationShixiong Ou
The framebuffer size calculation `fb_size = linebytes * height` can overflow when both values are large (e.g., 46341 * 46341 > INT_MAX). Since linebytes and height are both int types, the multiplication is performed as int * int, which results in undefined behavior on overflow. Use check_mul_overflow() to detect and prevent this overflow, consistent with the approach used in simpledrm.c and corebootdrm.c. Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Fixes: c8a17756c425 ("drm/ofdrm: Add ofdrm for Open Firmware framebuffers") Cc: <stable@vger.kernel.org> # v6.2+ Link: https://patch.msgid.link/20260825104134.669676-1-oushixiong1025@163.com
2026-08-25ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()Yifei Gao
Commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list") dropped the synchronize_rcu() between unlinking the command receivers from intf->cmd_rcvrs and freeing them, updating only the comment that explains why the barrier is needed. The cmd_rcvrs list is still traversed under plain RCU: find_cmd_rcvr() walks it inside rcu_read_lock(), and handle_ipmb_get_msg_cmd() borrows rcvr->user from that lookup within the same read-side section. Without the grace period, _ipmi_destroy_user() can kfree() a cmd_rcvr while a reader still holds a pointer to it, causing a use-after-free. The rework only made srcu unnecessary for the interfaces list; the cmd_rcvrs list still relies on plain RCU. Restore the synchronize_rcu() before freeing the receivers. Fixes: 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Yifei Gao <gyf161023@gmail.com> Message-ID: <20260825234630.1196170-1-gyf161023@gmail.com> Signed-off-by: Corey Minyard <corey@minyard.net>
2026-08-25drm/amdgpu: correct mcm_addr_lut value for gc v12_1Likun Gao
Correct GFX_IMU_MCM_ADDR_LUT_PF register value to suit for xcc harvest situation. Signed-off-by: Likun Gao <Likun.Gao@amd.com> Reviewed-by: Jinzhou Su <jinzhou.su@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: update mcm_addr_lut data for imu v12_1Likun Gao
Support for partition mode to program MCM_ADDR_LUT. Signed-off-by: Likun Gao <Likun.Gao@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: Init mcm_addr look up tableHawking Zhang
Encode mcm address look up table in SPX mode as a temp solution. v2: fill in when interface is ready (Alex) Signed-off-by: Hawking Zhang <Hawking.Zhang@amd.com> Reviewed-by: Likun Gao <Likun.Gao@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: update mcm_addr_lut data for imu v12_1Likun Gao
Support for partition mode to program MCM_ADDR_LUT. v2: clean up (Alex) Signed-off-by: Likun Gao <Likun.Gao@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdkfd: gfx12.1 add no-op prefetch on trap entryJay Cornwall
VMEM instructions may hang after trap exit. Issue a no-op prefetch to reset wave VMEM state. v2: squash in preserve SCC on trap entry Signed-off-by: Jay Cornwall <jay.cornwall@amd.com> Cc: Joseph Greathouse <joseph.greathouse@amd.com> Cc: Michael Chen <michael.chen@amd.com> Cc: Lancelot Six <lancelot.six@amd.com> Cc: Vladimir Indic <vladimir.indic@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdkfd: enable trap ID work aroundJames Zhu
on gfx12.1 trap handler Signed-off-by: James Zhu <James.Zhu@amd.com> Reviewed-by: Jay Cornwall <jay.cornwall@amd.com> Reviewed-by: Lancelot Six <lancelot.six@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdkfd: add stochastic in 1st trap handlerJames Zhu
to support gfx12.1.0 PC Sampling. Co-authored-by: Lancelot SIX <Lancelot.Six@amd.com> Co-authored-by: Jay Cornwall <jay.cornwall@amd.com> Co-authored-by: Joseph Greathouse <Joseph.Greathouse@amd.com> Signed-off-by: James Zhu <James.Zhu@amd.com> Reviewed-by: Jay Cornwall <jay.cornwall@amd.com> Reviewed-by: Vladimir Indic <Vladimir.Indic@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdkfd: enhance host trap process in 1st trap handlerJames Zhu
to support multiple processes, and process correctly when s_trap and context saving exception occur simultaneously. -v2: update comments advised from Lancelot -v3: update advised from Jay -v4: remove state bit S_SAVE_PC_HI_NEED_2ND_LVL_TH_SHIFT -v5: add STATUS.HALT handling Co-authored-by: Lancelot SIX <Lancelot.Six@amd.com> Co-authored-by: Joseph Greathouse <Joseph.Greathouse@amd.com> Signed-off-by: James Zhu <James.Zhu@amd.com> Reviewed-by: Lancelot SIX <Lancelot.Six@amd.com> Reviewed-by: Jay Cornwall <jay.cornwall@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: Skip showing available NPS modesLijo Lazar
Dynamic memory partition switch is not supported on CPU-GPU xgmi connected configurations. Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: skip DPX mode for unsupported GC partsMangesh Gadre
DPX is unsupported on GC 9.4.3/9.4.4/9.5.0 skip these 6-XCC parts,so do not advertise it. Signed-off-by: Mangesh Gadre <Mangesh.Gadre@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: add DPX mode for 6-XCC configurationMangesh Gadre
Add DPX to the 6-XCC supported mode mask This allows DPX to be advertised and selected Signed-off-by: Mangesh Gadre <Mangesh.Gadre@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: add NPS2 memory cap for soc v1.0 DPX modeLe Ma
DPX currently advertises only NPS1 as a compatible memory partition mode in soc_v1_0_get_xcp_res_info(). As a result, supported_nps_configs and amd-smi partition --accelerator report NPS1 for the DPX profile even when the device supports both NPS1 and NPS2. Include NPS2 in the DPX compatible NPS mask so the reported profile capabilities match the supported memory partition modes. Signed-off-by: Le Ma <le.ma@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: free memory partition info on gmc v12 sw_finiLe Ma
Reset the partition count and free the buffer on gmc v12 sw_fini during driver unload. Signed-off-by: Le Ma <le.ma@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: add memory partition sysfs init/fini for GC 12.1.0Le Ma
Add the nps sysfs node for GC 12.1.0 Signed-off-by: Le Ma <le.ma@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: init NPS supported modes for GC 12.1.0Le Ma
Add nps supported modes init for gc 12.1.0 Signed-off-by: Le Ma <le.ma@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: Init soc_v1_0 rev_id from IP discovery die_idHoratio Zhang
Software components need to detect die revisions in order to apply the correct software workarounds. During system boot, ASP firmware reads the IDCODE values from the MID, AID and XCD fuses and encodes the die revision into die_info[0].die_id in the IP discovery blob. v2: Default die_rev_id to 0 and warn instead of failing probe when IP discovery does not provide a die rev id. v3: Update names for external_rev_id enumerators. Signed-off-by: Horatio Zhang <hongkun.zhang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: handle LSDMA instance and harvest information from ip discoveryLe Ma
Track discovered LSDMA instances in inst_mask and clear harvested instances when processing the harvest table. Report the harvest state through IP discovery sysfs for LSDMA v7.1.0. Signed-off-by: Le Ma <le.ma@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: handle MMHUB harvest information from ip discoveryLe Ma
Clear harvested MMHUB instances from mmhub.inst_mask when processing the harvest table. Report the harvest state through IP discovery sysfs for MMHUB v4.2.0. Signed-off-by: Le Ma <le.ma@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu/discovery: skip MEM_RESERVED_INFO on unsupported ASICsFeifei Xu
Some ASICs' MEM_RESERVED_INFO table_entry may carry non-zero garbage, causing signature check failed thus probe fail. Move signature check in amdgpu_discovery_get_mem_reserved_info_table(), returning -ENOENT when invalid so the table is skipped. v1->v2: Add discovery binary header check before populate the mem_reserved_info table. (Lijo) Signed-off-by: Feifei Xu <Feifei.Xu@amd.com> Reviewed-by: Candice Li <candice.li@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: add mem_reserved_info sysfs attributeFeifei Xu
Expose the cached MEM_RESERVED_INFO discovery table via a per-device sysfs file: /sys/class/drm/cardX/device/mem_reserved_info The file is read-only and dumps every region as: list_num=<N> [<i>] id=<id> (<name>) size=0x<size> start=0x<start> Only created when the table was successfully resolved at discovery init time. Suggested-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Feifei Xu <Feifei.Xu@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: add amdgpu_discovery_dump_mem_reserved_info_tableFeifei Xu
Walk the cached MEM_RESERVED_INFO table once at discovery init time and log every entry (region id, symbolic name, size, start). Add for debugging purpose. Signed-off-by: Feifei Xu <Feifei.Xu@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-23 22:35:37 +0000