summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-15perf vendor events intel: Update emeraldrapids metricsChun-Tse Shao
The updated events were published in: https://github.com/intel/perfmon/commit/240735b7d8e0b50fe8f4a64e08399df13cb87ae6 Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf vendor events intel: Update sierraforest events from 1.17 to 1.18Chun-Tse Shao
The updated events were published in: https://github.com/intel/perfmon/commit/d1bc6c1e8b32e7a75c70cc939295c11ba9aabc96 Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf vendor events intel: Update pantherlake events from 1.06 to 1.07Chun-Tse Shao
The updated events were published in: https://github.com/intel/perfmon/commit/ce70546e9ccca4181d142057171c5bd820c8756d Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf vendor events intel: Add novalake v1.00 eventsChun-Tse Shao
The updated events were published in: https://github.com/intel/perfmon/commit/3aa49b06346e3a3ff40c7beabe63585591200c58 Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf vendor events intel: Update meteorlake events from 1.21 to 1.22Chun-Tse Shao
The updated events were published in: https://github.com/intel/perfmon/commit/704ef43e4c0738065a0575622cf7d31867b8d48b Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf vendor events intel: Update lunarlake events from 1.25 to 1.26Chun-Tse Shao
The updated events were published in: https://github.com/intel/perfmon/commit/2ba9dec72a771ed3ce7114d6a16797131871fd61 Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf vendor events intel: Update graniterapids events from 1.19 to 1.20Chun-Tse Shao
The updated events were published in: https://github.com/intel/perfmon/commit/084ecb869d75f9e5383354d3fe68a93aa25be112 Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf vendor events intel: Update grandridge events from 1.12 to 1.13Chun-Tse Shao
The updated events were published in: https://github.com/intel/perfmon/commit/e479bd676826824110a49505b51a92952de91200 Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf vendor events intel: Update clearwaterforest events from 1.02 to 1.04Chun-Tse Shao
The updated events were published in: https://github.com/intel/perfmon/commit/13983cd535d18b2bfd86a3b9daa374039f78a836 Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf vendor events intel: Update arrowlake events from 1.19 to 1.20Chun-Tse Shao
The updated events were published in: https://github.com/intel/perfmon/commit/b23ebe7bc25add0c835565e4bc87e063cb620a02 Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf vendor events intel: Update alderlaken events from 1.39 to 1.40Chun-Tse Shao
The updated events were published in: https://github.com/intel/perfmon/commit/7a14cc8feaf86772deb6708e96c8e9fee6d5b1ca Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf vendor events intel: Update alderlake events from 1.39 to 1.40Chun-Tse Shao
The updated events were published in: https://github.com/intel/perfmon/commit/7a14cc8feaf86772deb6708e96c8e9fee6d5b1ca Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf: evsel: Fix error handling in tp_format lookupHongling Zeng
In evsel__tp_format(), when trace_event__tp_format*() returns an error, IS_ERR() checks the local variable 'tp_format', but PTR_ERR() incorrectly uses 'evsel->tp_format' which hasn't been assigned yet. Fix this by using PTR_ERR(tp_format) to extract the error code from the correct variable. Fixes: 6c8310e8380d ("perf evsel: Allow evsel__newtp without libtraceevent") Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf doc: Fix mmap failure checks in topdown exampleHongfu Li
Use MAP_FAILED instead of NULL to detect mmap errors, and fix the slots_p variable name typo in the sample code. Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf jevents: Add Intel OMR MSR mappingsDapeng Mi
New OMR MSRs are introduced for OMR events on DMR and NVL. Perf continues to reuse the existing offcore_rsp attribute to encode the MSR value, similar to existing OCR event handling. Add the corresponding OMR MSR mappings in lookup_msr() so jevents can translate these events and generate the correct offcore_rsp attribute. Link: https://lore.kernel.org/all/20260114011750.350569-2-dapeng1.mi@linux.intel.com/ Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15perf test: Remove duplicate include of util/term.hChen Ni
Remove duplicate inclusion of util/term.h in builtin-test.c to clean up redundant code. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-15drm/xe/wopcm: fix WOPCM size for LNL+Daniele Ceraolo Spurio
Starting on LNL the WOPCM size is 8MB instead of 4, so we need to avoid using the [0, 8MB) range of the GGTT as that can be unaccessible from the microcontrollers. Note that the proper long-term fix here is to read the WOPCM size from the HW, but that is a more serious rework that would be difficult to backport, so we can do that as a follow-up. Fixes: 9c57bc08652a ("drm/xe/lnl: Drop force_probe requirement") Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Shuicheng Lin <shuicheng.lin@intel.com> Cc: Matt Roper <matthew.d.roper@intel.com> Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com> Link: https://patch.msgid.link/20260713221758.3285744-2-daniele.ceraolospurio@intel.com
2026-07-15ASoC: generic: Card name parsing should be called after xxx_for_each_link()Kuninori Morimoto
"tidyup simple_util_parse_xxx() in xxx_parse_of()" commit changed the function call order. But simple_util_parse_card_name() should be called after dai_link settings, because it might use dai_link->name as card->name. Fixes: fa6222d5e121 ("ASoC: audio-graph-card2: tidyup simple_util_parse_xxx() in audio_graph2_parse_of()") Fixes: b8081307f5c9 ("ASoC: audio-graph-card: tidyup simple_util_parse_xxx() in audio_graph_parse_of()") Fixes: 27ecf4da5ad3 ("ASoC: simple-card: tidyup simple_util_parse_xxx() in simple_parse_of()") Reported-by: Mark Brown <broonie@kernel.org> Link: https://lore.kernel.org/r/b81ebfa2-6a35-4ff0-9d04-b867233eda4d@sirena.org.uk Reported-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://lore.kernel.org/r/20260714103428.2318895-1-geert+renesas@glider.be Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/87zezt0zlw.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-15wifi: iwlwifi: mld: reset the driver state upon firmware recoveryEmmanuel Grumbach
Just like we did in iwlmvm, we also need to clear the mld state when the firmware was killed because of the device being powered off during suspend. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260714165826.ff1c9e05e0a9.I8df8d4a0384065fd2a32cf258339be77084c55bd@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: mvm: cleanup the driver state after device_powered_offEmmanuel Grumbach
If the device was powered off during suspend, we need to reload the firmware in resume which also means that we need to reconfigure it. It could be tempting to just set IWL_MVM_STATUS_HW_RESTART_REQUESTED but that would leave IWL_MVM_STATUS_IN_HW_RESTART set forever since that recovery is not managed by mac80211. Just call iwl_mvm_restart_cleanup() from device_powered_off(). Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260714165826.dc33533ac962.I6d7cca9c4e5643a477eae1d0a4f5fc83a10d0ee7@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: mvm: reset the smart fifo state upon FW stopEmmanuel Grumbach
The smart fifo is a feature in the firmware configured by the driver. The driver keeps a state to remember what was the last configuration sent to the firmware. Obviously, if the firmware stops, we need to reconfigure the smart fifo. Since we didn't reset that state upon firmware stop, we thought the firmware is already properly configured and we didn't send the smart fifo configuration command as part of the init sequence. Reset the smart fifo state in iwl_mvm_stop_device() so that we will properly send the command during the init that will come later. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260714165826.7d3c5efe2d1a.I16b23c328a677257257f695fa6f439e41fbcd081@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: regulatory: add LARI_CONFIG_CHANGE command v14 supportPagadala Yesu Anjaneyulu
Add support for LARI_CONFIG_CHANGE version 14 and populate the newly added BIOS-related fields in the command payload. Extend the version 14 command layout with UHB extension, puncturing and WBEM metadata fields, update command-size handling for version negotiation, and wire the new data into the LARI configuration flow. Track WBEM and puncturing source/revision in fw runtime, set them when loading ACPI or UEFI tables, and pass the headers to firmware. Update send conditions, debug traces, and related documentation/comments to match the new format. Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> Link: https://patch.msgid.link/20260714165826.c73d2fbebbfe.I93af7c456f04ef10d03646a43aaeb1858ecdc36d@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: ignore raw-DSM TLV for LARI cmd version 13 and abovePagadala Yesu Anjaneyulu
LARI_CONFIG_CHANGE command version 13 and above accepts raw DSM values by default in firmware, so FW_ACCEPTS_RAW_DSM_TABLE should not gate DSM bitmap handling for these versions. Set has_raw_dsm_capa based on command version (version 13 and above is true) with TLV fallback for older command versions. Also update TLV kernel-doc to mark this capability obsolete for LARI command version 13 and above. Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> Reviewed-by: Avinash Bhatt <avinash.bhatt@intel.com> Link: https://patch.msgid.link/20260714165826.12c8b407e115.I6809041f1eb52b7fafe9172ca3e47323d43cc30a@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: pcie: validate txq_id in txq_enableEmmanuel Grumbach
Avoid indexing txq arrays and queue-used bitmaps with an invalid queue ID by adding an early bounds check in iwl_trans_pcie_txq_enable(). Assisted-by: GitHubCopilot:gpt-5.3-codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260714165826.273be072f5ff.I0d6c36a4c06bdbb4655164c7792da32b6143731e@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: mld: validate D3_END notif sizeEmmanuel Grumbach
Check D3_END_NOTIFICATION payload length before reading notif->flags. On short payloads, mark notif handling as failed. Avoid out-of-bounds reads from malformed notifications. Assisted-by: GitHubCopilot:gpt-5.3-codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260714165826.db2df8b6b6bb.I6163bbdf433379bf1dbf9eb46fb9562892217bd7@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: mld: cancel wiphy work before freeing wiphyMiri Korenblit
When we fail to load the fw during op-mode start, we purge the list of the async handlers but we don't cancel the work. Same when we stop the op-mode. Before freeing wiphy, we need to cancel/flush any pending wiphy work, otherwise the work will fire with a freed memory. cfg80211 will do it anyway, but it will warn. Cancel the work in those cases. Reviewed-by: Johannes Berg <johannes.berg@intel.com> Link: https://patch.msgid.link/20260714165826.07aa49f755a2.I734a27b1b0eeb5b0e821aee3318fee8dc0a6bc03@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: mvm: validate monitor notif link_idEmmanuel Grumbach
MONITOR_NOTIF link_id is firmware-provided. Validate link_id range with IWL_FW_CHECK before vif lookup. Payload length is already checked by RX_HANDLER. Use iwl_mvm_rcu_dereference_vif_id which does all we need which allows us to drop iwl_mvm_get_vif_by_macid. Assisted-by: GitHubCopilot:gpt-5.3-codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260714165826.7601d05649a4.I237f58a007af761468057c9c09039953a3bb37da@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: mld: treat valid BAID without STA as a FW errorEmmanuel Grumbach
Somehow, the firmware sometimes seems to have a valid BAID even if the ieee80211_sta was not found. This happens in sniffer mode. Treat those as a firmware error. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260714165826.4902f73de145.I2cec7133f2a2ec8c39dcfb36938aba2ea3d6be24@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: mvm: fix the FCS truncation logic in d3Emmanuel Grumbach
Fix a harmless mistake in the wake packet management code in the d3 wakeup flow. If the FCS is truncated, we want to detect it, but we cleared the icvlen before updating the truncated variable that holds the number of bytes having been truncated. Fix that. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260714165826.a7d094168ed3.I1a4d13f276c7e75514ab2032ae387873337470b8@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: support TTL platform device IDMiri Korenblit
Add support for a new device ID that we will have on TTL (sc2). Reviewed-by: Johannes Berg <johannes.berg@intel.com> Link: https://patch.msgid.link/20260714165826.46183446954f.Icc260831e530c1c92c9be615a7077768b1b9ae30@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: claim UHR DBE capability for UHR devicesJohannes Berg
When an Intel device supports UHR it also supports DBE (dynamic bandwidth extension) since that's handled in mac80211. Claim support for it for client mode. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Link: https://patch.msgid.link/20260714165826.435828046f11.I538b2d90a4c282118ca2e56292cf5615d477a44c@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: mvm: remove iwl_mvm_recalc_tcm()Johannes Berg
This function is only called in the worker, so it doesn't need to exist at all, simply move the code there. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Link: https://patch.msgid.link/20260714165826.dd9f49714128.I65fbe6890d67ec424d333c362aa7041a117aed44@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: add a compile time check for too long hcmdsMiri Korenblit
A host command that is bigger than the allowed payload length should be sent with the NOCOPY flag. If it is sent without, we will get a warning. We do know at compile time what is the maximum size of a hcmd payload that the transport supports, so in order to catch bugs early, add a compile time check to iwl_*_send_cmd_pdu to catch that. Reviewed-by: Johannes Berg <johannes.berg@intel.com> Link: https://patch.msgid.link/20260714165826.a549b9499e3e.Id1a95bbbf92b5862862becaf57419bb9fe1385e5@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: validate UEFI reduced-power SKU TLV lengthPengpeng Hou
iwl_uefi_reduce_power_parse() reads an iwl_sku_id from an IWL_UCODE_TLV_PNVM_SKU payload after only checking that the generic TLV payload is present. A short type-specific payload can therefore make the three data[] reads extend beyond the TLV. Reject SKU TLVs shorter than the structure before accessing it. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260715135916.24417-2-pengpeng@iscas.ac.cn Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15wifi: iwlwifi: validate PNVM SKU TLV lengthPengpeng Hou
iwl_pnvm_parse() reads an iwl_sku_id from an IWL_UCODE_TLV_PNVM_SKU payload after only checking that the generic TLV payload is present. A short type-specific payload can therefore make the three data[] reads extend beyond the TLV. Reject SKU TLVs shorter than the structure before accessing it. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260715135916.24417-1-pengpeng@iscas.ac.cn Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-15ASoC: cs35l56: Add support for CS35L62Mark Brown
Richard Fitzgerald <rf@opensource.cirrus.com> says: The Cirrus Logic CS35L62 amp is similar to the CS35L63 and can be supported by adding the chip IDs into the cs35l56 driver. It must also be added to the codec table in sdw_utils. Link: https://patch.msgid.link/20260715120135.939280-1-rf@opensource.cirrus.com
2026-07-15ASoC: sdw_utils: Add codec info for CS35L62Stefan Binding
CS35L62 is very similar to CS35L63, and uses the same driver, so we can use the same configuration. Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com> Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> Link: https://patch.msgid.link/20260715120135.939280-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-15ASoC: cs35l56: Add support for CS35L62 for SoundWireStefan Binding
CS35L62 uses the same control and regmap interface as CS35L63 so support for it can be added into the CS35L56 driver. Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com> Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> Link: https://patch.msgid.link/20260715120135.939280-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-15dt-bindings: remoteproc: Drop redundant $ref of firmware-name propertyKrzysztof Kozlowski
The DT schema core defines the type ($ref) of 'firmware-name' property as string-array, so individual schemas do not need to. They also should not redefine it to a single string, but instead just set number of expected firmware names. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260712145718.126492-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org> Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15remoteproc: qcom_q6v5_pas: Create platform device for BAM-DMUXVishnu Santhosh
Some Qualcomm SoCs using the generic PAS remoteproc driver (e.g. Shikra) implement the BAM-DMUX protocol on the modem remoteproc to expose network data channels. The hardware/firmware resources required by the BAM-DMUX driver are described in an extra device tree node below the modem remoteproc, with the compatible "qcom,bam-dmux". qcom_q6v5_mss.c already creates a platform device for this node (commit 59983c74fc42 ("remoteproc: qcom_q6v5_mss: Create platform device for BAM-DMUX")), but qcom_q6v5_pas.c has no equivalent logic, so the bam-dmux node never probes on SoCs handled by this driver. Mirror the qcom_q6v5_mss.c approach: create a platform device specifically for the "qcom,bam-dmux" child node on probe, and destroy it on remove. of_get_compatible_child() returns NULL when the node is absent, and of_platform_device_create()/of_node_put() are NULL-safe, so this is a no-op for the many PAS-based SoCs that have no bam-dmux child. Signed-off-by: Vishnu Santhosh <vishnu.santhosh@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260711-qcom-q6v5-pas-bam-dmux-v1-1-1e9231143b79@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15remoteproc: core: cancel crash_handler work in rproc_add() error pathJingyi Wang
Ensure crash_handler work is cancelled before tearing down rproc resources to avoid accessing freed memory. Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260623-rproc-attach-issue-v3-3-8e24310707ce@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15remoteproc: qcom: Check subdev start status in rproc_stop()Jingyi Wang
For rproc that doing attach, rproc_start_subdevices() is called only when attach successfully. If rproc_report_crash() is called in the attach function, rproc_boot_recovery()->rproc_stop()->rproc_stop_subdevices()-> glink_subdev_stop() could be called and cause NULL pointer dereference: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000300 Mem abort info: ... pc : qcom_glink_smem_unregister+0x14/0x48 [qcom_glink_smem] lr : glink_subdev_stop+0x1c/0x30 [qcom_common] ... Call trace: qcom_glink_smem_unregister+0x14/0x48 [qcom_glink_smem] (P) glink_subdev_stop+0x1c/0x30 [qcom_common] rproc_stop+0x58/0x17c rproc_trigger_recovery+0xb0/0x150 rproc_crash_handler_work+0xa4/0xc4 process_scheduled_works+0x18c/0x2d8 worker_thread+0x144/0x280 kthread+0x124/0x138 ret_from_fork+0x10/0x20 Code: a9be7bfd 910003fd a90153f3 aa0003f3 (b9430000) ---[ end trace 0000000000000000 ]--- Introduce "subdevs_started" flag to indicate rproc_start_subdevices() has been called successfully. Ensure subdevices are only stopped if they have been started. Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260623-rproc-attach-issue-v3-2-8e24310707ce@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15remoteproc: core: Attach rproc asynchronously in rproc_add() path via ↵Jingyi Wang
schedule_work() Unlike the remoteproc firmware load path where rproc_add() call rproc_auto_boot_callback() asynchronously and ignores the return value of rproc_boot(), the attach path calls rproc_boot() synchronously and propagates its return value back to rproc_add(). This means a failure during rproc_attach() causes rproc_add() to fail and triggers resource release, removing the remoteproc from sysfs and making it unavailable for recovery or further boot attempts. Align the remoteproc attach path with the firmware load path by introducing attach_work and scheduling rproc_boot() asynchronously via schedule_work(). This keeps the remoteproc registered and available in sysfs even if the initial attach attempt fails, and avoids blocking rproc_add() on the attach result. Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260623-rproc-attach-issue-v3-1-8e24310707ce@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15dt-bindings: remoteproc: qcom,sm8550-pas: Add Qualcomm Maili ADSP and CDSPYijie Yang
Document compatible strings for the ADSP and CDSP Peripheral Authentication Services on the Qualcomm Maili SoC. Both are compatible with the Qualcomm SM8550 PAS and can fallback to SM8550 except for one additional interrupt ("shutdown-ack"). For CDSP, similar to Kaanapali, "global_sync_mem" is not managed by the kernel. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Yijie Yang <yijie.yang@oss.qualcomm.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Acked-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260615-remoteproc-v1-1-67721b4b052a@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15remoteproc: qcom: q6v5: Make handover IRQ one-shotAbel Vesa
The handover interrupt is expected to be consumed once during each prepare cycle. If the remote processor keeps signalling handover after the first event, qcom_q6v5 currently logs the duplicate interrupt repeatedly while leaving the IRQ enabled. Track the handover IRQ enable state explicitly and route all handover IRQ enable/disable operations through idempotent helpers. Request the handover IRQ with IRQF_NO_AUTOEN so it is only enabled through the helper during prepare. The handover handler disables it after marking handover as issued, while unprepare disables and synchronizes it before checking whether handover was issued. Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260612-rproc-q6v5-handover-irq-one-shot-v1-1-bb688f4446b3@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdevUday Khare
In qcom_add_glink_subdev(), the device node reference acquired via of_get_child_by_name() is stored in glink->node. If the subsequent kstrdup_const() allocation for glink->ssr_name fails, the function returns early without calling of_node_put() on glink->node, leaking the reference count. Fix this by adding of_node_put(glink->node) on the error path before returning. Fixes: cd9fc8f1b35b ("remoteproc: qcom: Pass ssr_name to glink subdevice") Signed-off-by: Uday Khare <udaykhare77@gmail.com> Link: https://lore.kernel.org/r/20260618132054.11010-1-udaykhare77@gmail.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15remoteproc: qcom_q6v5_mss: Fix MDM9607 subsystem control instance IDStephan Gerhold
On MDM9607, the modem firmware exposes the QMI subsystem control service with instance ID 0x22 (34), as visible e.g. with qrtr-lookup: $ qrtr-lookup Service Version Instance Node Port 43 2 34 3 1 Subsystem control service Currently, qcom_q6v5_mss uses ssctl_id 0x12 for all platforms. The QMI service never shows up with this ID, leading to the following error when trying to shutdown the modem: qcom-q6v5-mss 4080000.remoteproc: timeout waiting for ssctl service Set the correct ssctl_id to allow clean shutdown of the modem firmware with the subsystem control service. ssctl_id 0x22 is also used by other modem-only Qualcomm platforms in qcom_q6v5_pas, such as SDX55. Fixes: 4fe236a1d024 ("remoteproc: qcom_q6v5_mss: Add MDM9607") Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org> Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260706-qcom-q6v5-mss-mdm9607-ssctl-id-v1-2-f59e728af621@linaro.org Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15remoteproc: qcom_q6v5_mss: Make ssctl_id configurable per platformStephan Gerhold
Currently, qcom_q6v5_mss hardcodes 0x12 as the instance ID for the subsystem control (ssctl) QMI service. However, some platforms (e.g. MDM9607) provide the service with a different instance ID (0x22). Make it possible to override the ssctl_id per platform by adding it to the platform-specific rproc_hexagon_res struct. The same pattern also exists already inside qcom_q6v5_pas. Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260706-qcom-q6v5-mss-mdm9607-ssctl-id-v1-1-f59e728af621@linaro.org Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15remoteproc: qcom: pas: add needs_tzmem flag to trigger shmbridge creationAnanthu C V
SHM bridge creation is required to enable memory protection for both remoteproc metadata and its memory region on Qualcomm SoCs running non-Gunyah based Hypervisors. We currently rely on the iommu property being present in the remoteproc nodes to detect this. However, this doesn't cover for cases where the remoteproc does a late attach, like SoCCP, and for remoteprocs like OOBM SS (Out of Band Management Sub-system) that doesn't have an iommu in front of it. In the former case, any attempt to create new mappings would fail with EEXIST as they are already setup by the bootloader when the SoCCP is brought out of reset, and unmapping them to create fresh mappings leads to faults since SoCCP could have active transactions on the bus. In the latter case, absence of iommu will be caught by the has_iommu flag, and SHM bridge creation will be skipped. Fix this by introducing a needs_tzmem flag which would cover for the above edge cases by serving as an alternate trigger to the PAS helpers to ensure that SHM bridge is established. Signed-off-by: Ananthu C V <ananthu.cv@oss.qualcomm.com> Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260707-glymur-soccp-v5-1-053993f0c6fe@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()Mark Harris
When cpusetsize < cpumask_size(), hwprobe_get_cpus() did not fully initialize its copy of the cpu mask, which could cause non-deterministic results from the riscv_hwprobe syscall on a system with more than 8 CPUs when the supplied cpu mask is empty. Address this by fully initializing the cpu mask. Fixes: e178bf146e4b ("RISC-V: hwprobe: Introduce which-cpus flag") Signed-off-by: Mark Harris <mark.hsj@gmail.com> Reviewed-by: Nam Cao <namcao@linutronix.de> Reviewed-by: Michael Ellerman <mpe@kernel.org> Link: https://patch.msgid.link/20260714003056.73707-1-mark.hsj@gmail.com Signed-off-by: Paul Walmsley <pjw@kernel.org>