summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-08-10iommu/vt-d: Use kstrtoint_from_user() in dmar_perf_latency_write()Dmitry Antipov1-12/+4
Simplify 'dmar_perf_latency_write()' by using the convenient 'kstrtoint_from_user()'. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-10iommu/vt-d: Fix CACHE_TAG_NESTING_DEVTLB polluting shared variables in flush ↵Guanghui Feng1-3/+2
loop In cache_tag_flush_range(), the CACHE_TAG_NESTING_DEVTLB case modifies the shared local variables 'addr' and 'mask' before falling through to CACHE_TAG_DEVTLB. This causes all subsequent CACHE_TAG_DEVTLB entries in the same loop iteration to incorrectly use the full-range flush parameters (addr=0, mask=MAX_AGAW_PFN_WIDTH) instead of the precisely calculated PSI range. This is not the intended behavior, as regular DEVTLB entries should always perform targeted range-based invalidation. Fix this by having CACHE_TAG_NESTING_DEVTLB directly call cache_tag_flush_devtlb_psi() with the full-range constants and break, instead of modifying shared variables and falling through. This ensures CACHE_TAG_DEVTLB always uses the original calculated addr and mask for precise range flush. This change slightly affects trace_cache_tag_flush_range() behavior. Previously, after addr/mask were overwritten, the tracepoint could record a full-range flush even when the caller requested a narrower range. The tracepoint should reflect caller intent. Although this helper may widen the actual hardware invalidation range for implementation reasons, that does not change what the caller requested, so logging the requested range is the correct behavior. If the actual invalidation range sent to hardware is needed, it is already visible via the qi_submit trace event, which records the invalidation descriptors emitted by the driver. Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-10iommu/vt-d: Use logical OR operator for privilege mode checkLi RongQing1-1/+1
Replace bitwise OR (|) with logical OR (||) in the privilege mode validation check. While both operators produce the same result for boolean values (0 or 1), using logical OR is semantically correct and makes the intent clearer. No functional change, but improves code readability. Signed-off-by: Li RongQing <lirongqing@baidu.com> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-10iommu/vt-d: Fix UCTP context table slot when copying root entriesDesnes Nunes1-4/+6
When translation is already enabled at boot (e.g. kdump), the vt-d driver copies context tables from the previous kernel's root table. In scalable mode, buses that only populate the upper root half (UCTP, devfn >= 0x80) should be written to ctxt_tbls[tbl_idx + 1] through copy_context_table(). However, the current copy path always uses tbl[tbl_idx + 0] in this situa- tion. Since idx wraps to 0 at devfn 0x80 due to a zeroed LCTP, new_ce for LCTP will be NULL and keep pos equals to 0. Thus, UCTP entries will be co- pied into tbl[tbl_idx + 0] instead of tbl[tbl_idx + 1], and written after- wards to root_entry[bus].lo instead of .hi in copy_translation_tables(). In short, devices on bus 0x80 with devfn >= 0x80 fail DMA with fault 0x39, which will break drivers running in kernels with translation pre-enabled. This fixes NO_PASID DMAR faults for UCTP-only buses such as: DMAR: [DMA Read NO_PASID] Request device [80:14.0] fault addr 0xe81759000 [fault reason 0x39] SM: Present bit in Root Entry is clear For instance, this fault yielded to locking issues between systemd and xHCI, blocking a system's reboot after a vmcore was captured with kdump: systemd-udevd[246]: usb3: Worker [255] processing SEQNUM=2193 is taking a long time dracut-initqueue[277]: Timed out while waiting for udev queue to empty. systemd-udevd[246]: usb3: Worker [255] processing SEQNUM=2193 killed systemd-udevd[246]: usb3: Worker [255] terminated by signal 9 (KILL). ... kdump[569]: saving vmcore complete ... systemd-shutdown[1]: Rebooting. INFO: task kworker/0:1:11 blocked for more than 122 seconds. Not tainted 7.0.0-clean #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208160 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: <TASK> __schedule+0x299/0x5c0 schedule+0x27/0x80 schedule_timeout+0xbd/0x100 __wait_for_common+0x97/0x1b0 ? __pfx_schedule_timeout+0x10/0x10 xhci_alloc_dev+0x9e/0x2b0 usb_alloc_dev+0x7a/0x3b0 hub_port_connect+0x285/0x960 hub_port_connect_change+0x94/0x290 port_event+0x4bb/0x840 hub_event+0x141/0x460 process_one_work+0x196/0x390 worker_thread+0x1af/0x320 ? __pfx_worker_thread+0x10/0x10 kthread+0xe3/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x199/0x260 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> INFO: task systemd-shutdow:1 blocked for more than 122 seconds. Not tainted 7.0.0-clean #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:systemd-shutdow state:D stack:0 pid:1 tgid:1 ppid:0 task_flags:0x400100 flags:0x00080000 Call Trace: <TASK> __schedule+0x299/0x5c0 schedule+0x27/0x80 schedule_preempt_disabled+0x15/0x30 __mutex_lock.constprop.0+0x547/0xac0 device_shutdown+0xac/0x1b0 kernel_restart+0x3a/0x70 __do_sys_reboot+0x147/0x240 do_syscall_64+0x11b/0x6a0 ? handle_mm_fault+0x110/0x350 ? do_user_addr_fault+0x206/0x680 ? irqentry_exit+0x7a/0x4d0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe2958da917 RSP: 002b:00007ffc5c458618 EFLAGS: 00000206 ORIG_RAX: 00000000000000a9 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe2958da917 RDX: 0000000001234567 RSI: 0000000028121969 RDI: 00000000fee1dead RBP: 00007ffc5c458790 R08: 0000000000000069 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 00007ffc5c4588b8 R15: 0000000000000000 </TASK> INFO: task systemd-shutdow:1 is blocked on a mutex likely owned by task kworker/0:1:11. Fixes: 091d42e43d21 ("iommu/vt-d: Copy translation tables from old kernel") Signed-off-by: Desnes Nunes <desnesn@redhat.com> Tested-by: Tao Liu <ltao@redhat.com> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> Reviewed-by: Samiullah Khawaja <skhawaja@google.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-10Merge tag 'qcom-drivers-for-7.3-2' of ↵Arnd Bergmann16-100/+610
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers More Qualcomm driver updates for v7.3 Add SMEM parsing for DDR configuration data and use its highest bank address bit to select the appropriate UBWC configuration. Enable generic PAS trusted-zone APIs for the Iris and Venus media drivers. Fix SCM probe retry state, reserved-memory cleanup, and an early IRQ-handler NULL dereference. Enable QSEECOM EFI variable access on the Asus Zenbook A16. Correct GENI firmware-size validation using the hardware CFG RAM depth and correct the PMIC GLINK Thunderbolt extradata layout. Document the Nord AOSS side channel and the IMEM minidump SRAM property. Clean up Qualcomm statistics macros and the WCNSS binding schema. * tag 'qcom-drivers-for-7.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: media: qcom: Switch to generic PAS TZ APIs dt-bindings: soc: qcom,aoss-qmp: Document Nord AOSS side channel dt-bindings: sram: qcom,imem: Add minidump-sram pattern property soc: qcom: qcom_stats: Replace CLIENT_VOTES_OFFSET macro with sizeof() soc: qcom: qcom_stats: Remove unused macro definitions soc: qcom: ubwc: Get HBB from SMEM soc: qcom: smem: Expose DDR data from SMEM soc: qcom: smem: Use 'unsigned int' instead of 'unsigned' firmware: qcom: scm: Fix tzmem state on probe retry firmware: qcom: scm: Fix reserved memory cleanup on probe failure firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A16 (UX3607OA) soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size soc: qcom: pmic_glink_altmode: Define the TBT extradata properly dt-bindings: soc: qcom,wcnss: Drop redundant $ref of firmware-name property Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-10iommu/dma: Restore locking around msi_page_listAndrew Jones1-0/+13
Unlike a group's default domain, which is always freshly allocated and privately owned (iommu_group_alloc_default_domain()), VFIO type1's legacy container merges any newly attached group into an existing domain whenever their iommu_ops and cache-coherency enforcement match. iommu_dma_get_msi_page() only asserts the caller's own group mutex is held (iommu_group_mutex_assert()). On an IOMMU that publishes IOMMU_RESV_SW_MSI, e.g. ARM SMMU, a VM with two such devices assigned through the legacy container can have their guest drivers probe and allocate MSIs in parallel; each host-side VFIO_DEVICE_SET_IRQS lands on a different device fd and group mutex, but both devices' domains are the same merged domain, so both can enter iommu_dma_get_msi_page() concurrently and corrupt msi_page_list. commit 288683c92b1a ("iommu: Make iommu_dma_prepare_msi() into a generic operation") dropped the prior msi_prepare_lock on the reasoning that "each iommu_domain is unique to a group," which holds for default domains but not this VFIO type1 case. Restore the static lock, since it's only guarding a corner case and will likely never be contended. iommufd avoids the equivalent problem by having its own callers (iommufd_sw_map_msi()) take a ctx-wide sw_msi_lock before ever reaching the shared list. VFIO type1 can't mirror that since it dispatches to iommu_dma_sw_msi() which is outside VFIO's jurisdiction. Fixes: 288683c92b1a ("iommu: Make iommu_dma_prepare_msi() into a generic operation") Signed-off-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Nutty Liu <nutty.liu@hotmail.com> Reviewed-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-10Merge tag 'qcomtee-for-v7.3' of ↵Arnd Bergmann1-1/+6
git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers Drop unused assignment of platform_device_id driver data * tag 'qcomtee-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: qcomtee: Drop unused assignment of platform_device_id driver data Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-10iommupt: Return zero for invalid iova_to_phys() rangesShuai Xue1-1/+1
DOMAIN_NS(iova_to_phys) returns a phys_addr_t and follows the IOMMU iova_to_phys() convention of returning 0 when there is no valid translation. make_range() returns a negative errno if the input IOVA cannot be represented by this page table format. Returning that errno directly casts it to phys_addr_t. Callers treat zero as no translation and use non-zero values as physical addresses, so this can make them consume a bogus physical address instead of seeing a failed translation. Match the page-table walk failure path and return 0 for range validation failures too. Fixes: 9d4c274cd7d5 ("iommupt: Add iova_to_phys op") Cc: stable@vger.kernel.org Assisted-by: Qoder:Qwen-3.8-MAX-Preview Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com> Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-10iommufd: Release current IOAS on xa_store() failureShuai Xue1-0/+2
iommufd_take_all_iova_rwsem() takes an object reference and the iova_rwsem write lock before storing the IOAS in the temporary ioas_list xarray. If xa_store() fails, the current IOAS has not been inserted into ioas_list yet. iommufd_release_all_iova_rwsem() only unwinds IOAS objects already present in that xarray, so it cannot release the current IOAS. Release the current IOAS rwsem and object reference before unwinding the previously stored entries. Fixes: 051ae5aa73d7 ("iommufd: Lock all IOAS objects") Cc: stable@vger.kernel.org Assisted-by: Qoder:Qwen-3.8-MAX-Preview Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-10iommufd: Avoid locking internal accesses during unmapShuai Xue1-2/+2
iommufd_access_notify_unmap() skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufd_lock_obj() before checking whether the access is internal. If iommufd_lock_obj() succeeds, the loop then sees the internal access and continues, bypassing the matching iommufd_put_object() used by the normal unmap path. This leaks the object reference taken by iommufd_lock_obj(). Check for internal accesses first so skipped entries are never locked. Fixes: 27b77ea5feaa ("iommufd/access: Bypass access->ops->unmap for internal use") Cc: stable@vger.kernel.org Assisted-by: Qoder:Qwen-3.8-MAX-Preview Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-10iommu/sva: Set handle->dev before the SVA handle is visibleShuai Xue1-1/+1
iommu_attach_device_pasid() installs the new SVA attach handle in the group PASID lookup before iommu_sva_bind_device() returns. A concurrent bind can therefore find and reuse the same handle after iommu_sva_lock is dropped. handle->dev was initialized after dropping iommu_sva_lock. This leaves a window where a racing bind can return a handle whose dev pointer is still NULL. A subsequent iommu_sva_unbind_device() can then dereference it via handle->dev->iommu_group. Initialize handle->dev before releasing iommu_sva_lock so any visible SVA handle is fully initialized. Fixes: be51b1d6bbff ("iommu/sva: Refactoring iommu_sva_bind/unbind_device()") Cc: stable@vger.kernel.org Assisted-by: Qoder:Qwen-3.8-MAX-Preview Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com> Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-10Merge tag 'ti-driver-soc-for-v7.3' of ↵Arnd Bergmann4-5/+11
https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/drivers TI SoC driver updates for v7.3 Minor bug fixes and cleanups across TI SoC and firmware drivers: - firmware: ti_sci: Fix a resource leak by undoing list publication when device populate fails, ensuring proper cleanup on error paths - soc: ti: knav_qmss: Remove debugfs file on teardown to avoid stale entries and potential use-after-free scenarios - soc: ti: wkup_m3_ipc: Remove redundant dev_err() call to avoid duplicate error reporting * tag 'ti-driver-soc-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: soc: ti: wkup_m3_ipc: Remove redundant dev_err() soc: ti: knav_qmss: Remove debugfs file on teardown firmware: ti_sci: Undo list publication on populate failure Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-10firmware: xilinx: Clear firmware notifiers across kexec transitionsJay Buddhabhatti1-0/+14
During a kexec restart, only the kernel is reloaded but notifier callbacks in firmware persist, causing state mismatches between kernel and firmware. To address this, introduce PM_ALL_NOTIFIERS node ID to unregister all notifier callbacks during kexec. On a graceful kexec restart, this occurs in zynqmp_firmware_shutdown(). On a crash kernel restart, it happens in zynqmp_firmware_probe() in the reloaded kernel. Unregistering all notifiers depends on firmware support for the PM_ALL_NOTIFIERS node ID. On firmware that does not implement it (the feature check reports a version below PM_API_VERSION_3) the step is skipped and a warning such as "Firmware doesn't support unregister all notifiers at once" is logged, e.g. on Versal NET firmware that predates this API. Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Reviewed-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com> Link: https://patch.msgid.link/20260729122522.3732875-4-jay.buddhabhatti@amd.com Signed-off-by: Michal Simek <michal.simek@amd.com>
2026-08-10firmware: xilinx: Release all peripheral devices from firmwareJay Buddhabhatti1-1/+14
During a kexec restart, only the kernel is reloaded while devices allocated in firmware persist, causing state mismatches between the kernel and firmware. Introduce PM_DEV_ALL_PERIPH node ID (0x18224FFFU) to release all peripheral devices during kexec. On graceful restarts, this happens in zynqmp_firmware_shutdown(). On crash kernel restarts, it happens in zynqmp_firmware_probe() of the reloaded kernel. Releasing all peripherals depends on firmware support for the PM_DEV_ALL_PERIPH node ID. On firmware that does not implement it (the feature check reports a version below PM_API_VERSION_3) the release is skipped and a warning such as "Bulk device release is not supported by firmware" is logged, e.g. on Versal NET firmware that predates this API. Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Reviewed-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com> Link: https://patch.msgid.link/20260729122522.3732875-3-jay.buddhabhatti@amd.com Signed-off-by: Michal Simek <michal.simek@amd.com>
2026-08-10firmware: xilinx: Add support to clear EL3 PM stateJay Buddhabhatti1-1/+49
Currently, during a kexec restart, only the kernel is reloaded, while EL3-specific data remain unchanged. This leads to a mismatch between the kernel state and secure firmware state like SGI number and shutdown scope variable. For example, the kernel registers an SGI number with EL3 firmware so that secure firmware can notify the kernel of events via that SGI. EL3 stores this SGI number in its internal state. After a kexec, the newly loaded kernel re-registers and may request a different SGI number, but the stale value programmed in EL3 remains, so event notifications are delivered on the old SGI and are missed by the new kernel. The shutdown scope variable has a similar stale state problem. To resolve this, the TF_A_CLEAR_PM_STATE PM API is introduced to clear EL3 PM subsystem state during kexec. On a graceful reboot, this API is triggered by zynqmp_firmware_shutdown(), while in a crash kernel scenario, it is invoked by zynqmp_firmware_probe() in the reloaded kernel. Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Reviewed-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com> Link: https://patch.msgid.link/20260729122522.3732875-2-jay.buddhabhatti@amd.com Signed-off-by: Michal Simek <michal.simek@amd.com>
2026-08-10firmware: xilinx: Propagate actual error from feature checkJay Buddhabhatti1-4/+2
When do_fw_call() fails in __do_feature_check_call(), propagate the actual errno from zynqmp_pm_ret_code() instead of always returning -EOPNOTSUPP. This gives callers more precise error information. Existing callers only test ret < 0 and are unchanged by this. Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Reviewed-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com> Link: https://patch.msgid.link/20260724095352.2890326-3-jay.buddhabhatti@amd.com Signed-off-by: Michal Simek <michal.simek@amd.com>
2026-08-10firmware: xilinx: Use TF-A feature check for TF-A-specific APIsJay Buddhabhatti1-10/+15
Currently, TF-A-specific APIs are validated using the firmware PM_FEATURE_CHECK API, even though TF-A provides a dedicated mechanism via PM_API_FEATURES API. Update the feature check logic for TF-A-specific API calls to use PM_API_FEATURES. If this check fails, fall back to the legacy PM_FEATURE_CHECK to support backward compatibility. Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Reviewed-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com> Link: https://patch.msgid.link/20260724095352.2890326-2-jay.buddhabhatti@amd.com Signed-off-by: Michal Simek <michal.simek@amd.com>
2026-08-10Merge tag 'optee-fix-for-v7.2' of ↵Arnd Bergmann1-0/+3
git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes Add NULL check in optee_ffa_lend_protmem() * tag 'optee-fix-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: optee: ffa: Add NULL check in optee_ffa_lend_protmem Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-10fbdev: clps711x-fb: Remove unreachable unregister_framebuffer() callKarl Mehltretter1-2/+0
The unregister_framebuffer() call in clps711x_fb_probe() is unreachable. register_framebuffer() failure jumps to the unwind label, while success returns immediately. Remove it. Found with Clang's -Wunreachable-code. Fixes: 36462ac193088 ("fbdev: clps711x-fb: Replace check_fb in favor of struct fb_info.lcd_dev") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Acked-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: mb862xxfb: Silence possibly unused functionsHelge Deller1-3/+3
When CONFIG_PCI=n, the kernel test robot reports that on powerpc some functions and variables may possibly be unused. Silence those warnings. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202608081537.o23Goj8d-lkp@intel.com/ Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10sticon/parisc: Detect default STI graphics card for console outputHelge Deller1-1/+21
If a machine has multiple graphic cards, detect the graphic card which is used to display firmware messages and use that one as the default graphic card for sticon and fbcon. On parisc machines the default graphic card used for BCH (boot console handler, aka BIOS menu) is stored in the stable storage (equivalent to CMOS storage on x86) or in the console path in page zero. Extract that path and store it as default STI path for later comparism. Take care that the graphic card can be a GSC or a PCI card which use different path strings. Increase max string size for default_sti_path to 32 chars as the print_pa_hwpath() function formats a hardware path using unbounded sprintf calls for up to 6 bus converter components and 1 module component (e.g., 255/255/...), which can produce a string up to 28 bytes long. Signed-off-by: Helge Deller <deller@gmx.de> Cc: stable@vger.kernel.org
2026-08-10fbdev: ssd1307fb: defer I2C transfers from damage callbacksHui Su1-5/+67
The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update the display synchronously, which enters the sleeping I2C transfer path from atomic context. A complete report from an RK3566 system follows: [ 258.129004] watchdog: watchdog0: watchdog did not stop! [ 258.129067] BUG: scheduling while atomic: systemd/1/0x00000003 [ 258.129076] Modules linked in: algif_hash algif_skcipher af_alg bnep binfmt_misc lz4hc lz4 zram snd_soc_hdmi_codec brcmfmac_wcc hci_uart fb_ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd_soc_simple_card motorcomm pwm_fan snd_soc_simple_card_utils ssd130x_spi nls_iso8859_1 ssd130x btbcm drm_shmem_helper display_connector brcmfmac ssd1307fb brcmutil bluetooth cfg80211 rfkill snd_soc_rockchip_i2s_tdm snd_soc_rk817 hantro_vpu snd_soc_core snd_compress snd_pcm_dmaengine v4l2_vp9 snd_pcm v4l2_h264 rockchip_rga snd_timer rk_crypto2 spi_rockchip_sfc videobuf2_dma_contig snd sm3_generic v4l2_mem2mem videobuf2_dma_sg dwmac_rk sm3 soundcore videobuf2_memops videobuf2_v4l2 stmmac_platform dw_hdmi_cec videodev videobuf2_common dw_hdmi_i2s_audio stmmac rk817_charger pcs_xpcs mc cpufreq_dt sch_fq_codel ip_tables x_tables autofs4 [ 258.129215] Preemption disabled at: [ 258.129216] [<ffff80008012f96c>] vprintk_emit+0x11c/0x340 [ 258.129234] CPU: 0 PID: 1 Comm: systemd Tainted: G C 6.6.0-rc5-rockchip-rk356x #4 [ 258.129239] Hardware name: Rockchip RK3566 OPi 3B (DT) [ 258.129243] Call trace: [ 258.129245] dump_backtrace+0xa0/0x128 [ 258.129252] show_stack+0x20/0x38 [ 258.129256] dump_stack_lvl+0x60/0xb0 [ 258.129265] dump_stack+0x18/0x28 [ 258.129269] __schedule_bug+0xa0/0xc8 [ 258.129274] __schedule+0x9ac/0xd30 [ 258.129279] schedule+0x60/0x100 [ 258.129282] schedule_timeout+0x194/0x338 [ 258.129289] rk3x_i2c_xfer_common.isra.0+0x384/0x498 [ 258.129296] rk3x_i2c_xfer+0x20/0x60 [ 258.129300] __i2c_transfer+0x194/0x648 [ 258.129308] i2c_transfer+0x9c/0x130 [ 258.129313] i2c_transfer_buffer_flags+0x64/0x98 [ 258.129318] ssd1307fb_update_rect+0x42c/0x560 [ssd1307fb] [ 258.129334] ssd1307fb_defio_imageblit+0x34/0x50 [ssd1307fb] [ 258.129343] soft_cursor+0x13c/0x210 [ 258.129350] bit_cursor+0x2dc/0x550 [ 258.129354] fbcon_cursor+0xec/0x108 [ 258.129359] hide_cursor+0x44/0xc8 [ 258.129365] vt_console_print+0x398/0x3b0 [ 258.129370] console_flush_all.isra.0+0x17c/0x410 [ 258.129377] console_unlock+0x4c/0x100 [ 258.129382] vprintk_emit+0x1c8/0x340 [ 258.129386] vprintk_default+0x40/0x58 [ 258.129389] vprintk+0xb8/0xd0 [ 258.129392] _printk+0x68/0x98 [ 258.129398] watchdog_release+0x170/0x230 [ 258.129404] __fput+0xbc/0x288 [ 258.129409] __fput_sync+0x58/0x70 [ 258.129413] __arm64_sys_close+0x40/0x90 [ 258.129419] invoke_syscall+0x4c/0x118 [ 258.129426] el0_svc_common.constprop.0+0x48/0xf0 [ 258.129432] do_el0_svc+0x24/0x38 [ 258.129437] el0_svc+0x48/0x100 [ 258.129443] el0t_64_sync_handler+0xc0/0xc8 [ 258.129448] el0t_64_sync+0x190/0x198 [ 258.573087] ------------[ cut here ]------------ [ 258.573098] DEBUG_LOCKS_WARN_ON(val > preempt_count()) [ 258.573111] WARNING: CPU: 0 PID: 1 at kernel/sched/core.c:5871 preempt_count_sub+0x9c/0x148 [ 258.573130] Modules linked in: algif_hash algif_skcipher af_alg bnep binfmt_misc lz4hc lz4 zram snd_soc_hdmi_codec brcmfmac_wcc hci_uart fb_ssd1306(C) fbtft(C) btqca btrtl btintel btsdio snd_soc_simple_card motorcomm pwm_fan snd_soc_simple_card_utils ssd130x_spi nls_iso8859_1 ssd130x btbcm drm_shmem_helper display_connector brcmfmac ssd1307fb brcmutil bluetooth cfg80211 rfkill snd_soc_rockchip_i2s_tdm snd_soc_rk817 hantro_vpu snd_soc_core snd_compress snd_pcm_dmaengine v4l2_vp9 snd_pcm v4l2_h264 rockchip_rga snd_timer rk_crypto2 spi_rockchip_sfc videobuf2_dma_contig snd sm3_generic v4l2_mem2mem videobuf2_dma_sg dwmac_rk sm3 soundcore videobuf2_memops videobuf2_v4l2 stmmac_platform dw_hdmi_cec videodev videobuf2_common dw_hdmi_i2s_audio stmmac rk817_charger pcs_xpcs mc cpufreq_dt sch_fq_codel ip_tables x_tables autofs4 [ 258.573268] CPU: 0 PID: 1 Comm: systemd Tainted: G WC 6.6.0-rc5-rockchip-rk356x #4 [ 258.573274] Hardware name: Rockchip RK3566 OPi 3B (DT) ** 37 printk messages dropped ** [ 258.574064] Preemption disabled at: ** 42 printk messages dropped ** [ 259.190237] Preemption disabled at: Track damage in the driver's private data under a spinlock and merge multiple updates into a bounding rectangle. Queue the existing deferred-I/O work immediately for damage reported by fbdev drawing and write helpers, so allocation and I2C transfers run from process context without adding the configured mmap refresh delay. Keep full-screen updates for dirty mmap pages, for which no precise rectangle is available. Tested on an RK3566 board with a 128x64 OLED by running five rounds of 250 KERN_EMERG messages in total while issuing framebuffer writes every 15 ms. No atomic-sleep, preemption, or lockdep warning occurred. Kprobe tracing also confirmed that cursor-only damage remained an 8x16 partial update. Fixes: a2ed00da5047 ("drivers/video: add support for the Solomon SSD1307 OLED Controller") Cc: stable@vger.kernel.org Signed-off-by: Hui Su <sh_def@163.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: au1100fb: drop unneeded semicolonJulia Lawall1-1/+1
When a function-like macro expands to an expression, that expression doesn't need a semicolon after it. All uses have been verified to have their own semicolons. This was found using the following Coccinelle semantic patch: @r@ identifier i : script:ocaml() { String.lowercase_ascii i = i }; expression e; @@ *#define i(...) e; Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: tdfxfb: Program the initial video modeDaniel Palmer1-0/+8
If the card does not get bound to by fbcon set_par() never happens and the initial video mode is not setup and the display detects no signal. Program the video mode and also clear the framebuffer memory so random garbage isn't displayed. Signed-off-by: Daniel Palmer <daniel@0x0f.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: tdfxfb: Wake the VGA core before programming the CRTCDaniel Palmer1-0/+4
If the card was unbooted the VGA core needs to be woken up before poking at it. Signed-off-by: Daniel Palmer <daniel@0x0f.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: tdfxfb: Manually boot unbooted cardsDaniel Palmer1-3/+37
If the card is detected as being unbooted it isn't too difficult to use the config table in its BIOS to fire it up so do it. Signed-off-by: Daniel Palmer <daniel@0x0f.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: tdfxfb: Attempt to detect if the card wasn't bootedDaniel Palmer1-0/+31
Until now a card had to have been booted by its video BIOS otherwise the driver would probe, create the fb etc but there would be no output on the display. There doesn't seem to be a documented way work out if the BIOS ran or not. Checking if the values in registers match what is in the config table in the BIOS seems to be the only option. On my 16MB Voodoo 3 3000 checking the contents of the draminit0 register versus what is in the config table seems to be enough. Signed-off-by: Daniel Palmer <daniel@0x0f.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: tdfxfb: Add helper to read config table from BIOSDaniel Palmer1-0/+78
In the case that the video BIOS didn't run because the card isn't the primary card, the BIOS doesn't support running old skool video BIOS (modern BIOS without CSM), or the machine isn't x86 it needs to be booted manually. To do this the config table in the BIOS is needed. Add a helper to get the config table in preparation for manually booting cards. Signed-off-by: Daniel Palmer <daniel@0x0f.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: core: Clamp total_size to smem_len in read/write functionsMingyu Wang2-0/+32
Some legacy fbdev drivers may incorrectly set info->screen_size to a value larger than the actual mapped framebuffer size (info->fix.smem_len) during mode switches. This could allow out-of-bounds I/O and system memory accesses in fb_io_read(), fb_io_write(), fb_sys_read(), and fb_sys_write(). Prevent this by clamping total_size to smem_len when smem_len is non-zero. Virtual framebuffers (smem_len == 0) are unaffected. This is a hardening measure; no specific crash is fixed by this patch. Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: kyro: Validate overlay viewport coordinatesDanila Chernetsov1-1/+23
The overlay viewport end coordinates are computed from the viewport origin and dimensions using 32-bit unsigned arithmetic. Large input values can cause these calculations to wrap around before the resulting coordinates are passed to SetOverlayViewPort(). SetOverlayViewPort() packs the viewport coordinates into 16-bit register fields. The X coordinates are additionally adjusted by +2 and +1 before being written. Validate the coordinate calculations for 32-bit wraparound and ensure that the adjusted coordinates fit within their 16-bit register fields before calling SetOverlayViewPort(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Danila Chernetsov <listdansp@mail.ru> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: mb862xx: replace dead select with dependencyJulian Braha1-2/+1
'select' does not work on config options in a 'choice', so currently it is possible to enable FB_MB862XX_LIME without FB_LITTLE_ENDIAN. We cannot replace the 'select FB_LITTLE_ENDIAN' without also changing FB_FOREIGN_ENDIAN from 'select' to 'depends on', otherwise we will get a recursive dependency. Since the default choice is FB_BOTH_ENDIAN, let's use: 'depends on FB_LITTLE_ENDIAN || FB_BOTH_ENDIAN' to avoid breaking defconfig. This dead select was found by kconfirm, a static analysis tool for Kconfig. Suggested-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Julian Braha <julianbraha@gmail.com> Link: https://lore.kernel.org/all/20260722220023.196029-1-julianbraha@gmail.com/ Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: sa1100fb: Remove redundant dev_err()Pan Chuang1-3/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: s3c-fb: Remove redundant dev_err()Pan Chuang1-3/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: pxafb: Remove redundant dev_err()Pan Chuang1-1/+0
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: pxa3xx-gcu: Remove redundant dev_err()Pan Chuang1-3/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: pxa168fb: Remove redundant dev_err()Pan Chuang1-1/+0
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: omapfb/dsi-cm: Remove redundant dev_err()Pan Chuang1-3/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: mmp: Remove redundant dev_err()Pan Chuang1-2/+0
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: pvr2fb: correct user pointer annotation and sentinel initializerFlorian Fuchs1-2/+2
Add __user annotation to buf, as it is passed as a user pointer in pin_user_pages_fast(). Use an empty initializer for the sentinel board-table entry to avoid initializing a function pointer with an integer literal. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607131247.fpQ6eTc7-lkp@intel.com/ Cc: stable@vger.kernel.org Signed-off-by: Florian Fuchs <fuchsfl@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: udlfb: validate vendor descriptor itemsPengpeng Hou1-6/+16
dlfb_parse_vendor_descriptor() walks key-length-value items inside the DisplayLink vendor descriptor. Require each item to contain its key, length and declared value bytes before reading item-specific fields such as max_area. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: sstfb: add missing MODULE_DEVICE_TABLE()Pengpeng Hou1-0/+1
The driver has a match table for the pci bus wired into its driver structure, but the table is not exported with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE() entry so module alias information is generated for automatic module loading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the driver registration structure, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: omap2: dsi: do not copy isr tableAndreas Kemnade1-8/+1
To te able to unregister stuff from isrs, the corresponding table was copied. Nobody seems to unregister stuff that way, so it does not help. But there are stack-allocated objects passed to these isrs giving chances of UAF of these objects if irqs are unregistered while they are handled, so better do not copy that table. Suggested-by: sashiko-bot@kernel.org Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()Myeonghun Pak1-1/+1
tdfxfb_probe() enables the PCI device with pci_enable_device(), but several failure paths after that point return without disabling it. The framebuffer_alloc() failure path returns -ENOMEM directly, and the later shared out_err path releases the framebuffer and returns -ENXIO without balancing the PCI enable state. The successful probe path has the same imbalance because tdfxfb_remove() releases the framebuffer, mappings and regions, but never calls pci_disable_device(). Use pcim_enable_device() so the PCI device is disabled automatically on probe failure and driver detach. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10fbdev: uvesafb: unregister connector callback on init failureMyeonghun Pak1-0/+2
uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_driver_register() fails, the function returns the error directly and leaves the connector callback registered. The later platform-device failure path already unregisters the callback. Add the same cleanup before the final return when platform-driver registration fails. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10Merge tag 'drm-rust-next-2026-08-08' of ↵Dave Airlie75-2590/+5760
https://gitlab.freedesktop.org/drm/rust/kernel into drm-next DRM Rust changes for v7.3-rc1 - I/O (shared from driver-core tree via signed tag rust-io-7.3-rc1): - Rework of I/O types: make I/O regions typed (with a dynamically-sized Region type for the existing untyped case), create view types representing subregions of a mapped I/O region, and add io_project!() for safely creating subviews. - Split Io into a base trait (IoBase) and an extension trait (Io) with a blanket implementation, preventing implementers from overriding provided methods that unsafe code relies on. - Add a SysMem backend for shared system memory with volatile access, and make Coherent implement Io via an I/O view type. Add copying methods (memcpy_{from,to}io). - Replace dma_read!/dma_write! with io_read!/io_write!; drop the old macros. - DRM: - RegistrationGuard and RegistrationData: - Rework DeviceContext typestates: rename Uninit to Normal, add an Ioctl context, restrict AlwaysRefCounted to Normal for both Device and GEM Object, and establish a Deref chain from Registered to Normal. - Introduce RegistrationGuard, a guard representing a drm_dev_enter/exit SRCU critical section that proves the DRM device is registered, which implies the parent bus device is still bound. - Add RegistrationData as a GAT on drm::Driver. The data does not outlive driver unbind, so it can capture lifetime-annotated device resources and references. Accessible through the guard via a closure with HRTB lifetime. - Wrap ioctl dispatch in RegistrationGuard (returning ENODEV if unplugged) and pass registration data to handlers. - Add Driver::ParentDevice associated type. - Fix unbounded lifetimes in ioctl handler arguments. - Fix a race in drm_dev_register() where a partial failure allowed in-flight ioctls to proceed while the error path tore down resources. - GEM shmem: add DmaResvGuard helper, vmap functions, and sg_table() accessor. - GPUVM: require Send + Sync for the driver's associated data, implement Send and Sync for GpuVaAlloc and GpuVmBo, add SmContext lifetime bound, update DriverGpuVm for DeviceContext. - Nova: - nova-core / nova-drm cross-crate dependency: - Build nova-core and nova-drm from drivers/gpu/Makefile for build ordering, export nova-core Rust symbols for nova-drm. Workaround until the build system supports Rust cross-crate dependencies natively. - GSP boot process consolidation: - Introduce GspBootContext to bundle common boot parameters, replacing per-argument threading. Separate context and GPU lifetimes to support mutable borrows of GPU subdevices. - Turn FWSEC execution into a HAL method, make FWSEC bootloader usage a property of the TU102 HAL (GA102+ gets its own instance with it disabled). Move firmware file selection to the GSP HAL. - Store the Fsp instance in Gpu (lifetime tied to the GPU, not just a single boot invocation). Move GSP state and unload bundle into a pinned subobject for reliable teardown on partial init failure. - Boot GSP with vGPU enabled: - Add PRC (Product Reconfiguration Control) protocol to query device configuration from the FSP. Read vGPU mode, detect and store vGPU state. - Set RMSetSriovMode registry entry and reserve the larger WPR2 heap required when vGPU is enabled. - Build SetRegistry entries dynamically. - TLV firmware image format: - Add a TLV (type-length-value) parser for the new firmware image format. TLV files use unversioned filenames with a .tlv suffix, start with "NVFW" magic, and contain tagged blocks with 4-byte aligned payloads. - Transition all firmware loading (booter, gsp, gen_bootloader, fsp) to TLV images. - Note: this requires a development firmware not in linux-firmware [1]; this is temporary and serves the transition to r615. - Hopper/Blackwell fixes and cleanups: - Correct FRTS vidmem offset calculation, split FbLayout into FSP and non-FSP versions, fix Blackwell flush address composition, use absolute FBHUB0 flush registers on Blackwell, use correct sysmem flush registers on Hopper. - Harden FSP messaging: limit receive allocation size, catch bogus queue pointers, ensure DMA allocation lifetimes for FMC boot and LibOS, wait for RISC-V HALTED on unload. - I/O projection adoption: - Use io_project!() for PTE array, message queues, and Falcon DMA transfer bounds checking. - Misc: - Keep unloading if FWSEC-SB fails during Turing/Ampere GSP reset. - Don't declare booter firmware for FSP chipsets. - Fix packed registry table size. - Extract and display usable FB regions from GSP. - Store bar and dev directly in Falcon, simplifying the API. - Parse VBIOS structs via zerocopy. - Convert to kernel bitfield macro, remove local one. - Move register definitions into sub-modules. - Add FSP and PRC protocol documentation. - Tyr: - Firmware loading and MCU boot: - Add a generic slot manager for dynamically allocating limited hardware slots to software seats, with lazy eviction under contention. - Add MMU support wrapping the slot manager for address-space slot allocation, with MAIR-to-MEMATTR translation. - Add GPU virtual memory (VM) support using drm_gpuvm with ARM64 LPAE Stage 1 page tables and 4KB/2MB page sizes. - Add a kernel buffer object type for internal driver allocations. - Add a parser for the Mali CSF firmware binary format. - Add MCU booting: load, parse, and map firmware sections into VM, then boot the MCU at probe(). - Cross-subsystem: - Add faux::Device type with AsBusDevice support. Allow retrieving a bound Device from a Registration. - Add device lifetime to IoPageTable. - Add Vec::zeroed method. - Add firmware::request_into_buf() to load firmware into a caller-provided buffer. - Rename dma_handle to dma_address in the DMA abstraction. - Change pci_sriov_get_totalvfs() return type to unsigned int; add Rust helper. [1] https://github.com/ttabi/linux-firmware-nova Signed-off-by: Dave Airlie <airlied@redhat.com> From: "Danilo Krummrich" <dakr@kernel.org> Link: https://patch.msgid.link/DKJQQUOS0PVO.3JPR3MYK4PDVZ@kernel.org
2026-08-10Merge tag 'pin-init-v7.3' of https://github.com/Rust-for-Linux/linux into ↵Miguel Ojeda1-2/+2
rust-next Pull pin-init updates from Gary Guo: "User-visible changes: - Merge the '__pinned_init' and '__init' methods and make 'Init' a marker trait. - Introduce public APIs 'raw_init' and 'raw_try_init' to prevent users from needing to invoke the internal '__pinned_init'/'__init' methods. - Emit errors for duplicate '#[pin]' attributes. - Link 'Zeroable::zeroed' and 'pin_init::zeroed' in documentation. Other changes: - Fix unwind safety issues. - Clean up lint 'allow' and 'expect's. - Overhaul '#[cfg]' handling to pave the way for tuple structs and self-referential structs. - Mark many functions as '#[inline]' for better codegen with '-C opt-level=s' ('CC_OPTIMIZE_FOR_SIZE')." * tag 'pin-init-v7.3' of https://github.com/Rust-for-Linux/linux: rust: pin-init: add `#[inline]` to small functions rust: pin-init: remove `__pinned_init` method for `cfg(kernel)` rust: treewide: replace `__pinned_init` with `raw_[try_]init` rust: pin-init: add `raw_init` and `raw_try_init` and recommend over `__init` rust: pin-init: merge `__pinned_init` and `__init` rust: pin-init: examples: use `Wrapper::pin_init` instead of manual reimplementation rust: pin-init: mark `pin_init::zeroed` and `Zeroable::zeroed` as `#[inline]` rust: pin-init: docs: link `Zeroable::zeroed` and `pin_init::zeroed` in documentation rust: pin-init: internal: rework how `#[pin_data]` handles cfg rust: pin-init: make `[pin_]chain` unwind safe rust: pin-init: make `[pin_]init_array_from_fn` unwind safe rust: pin-init: internal: generate brace in macro for init code blocks rust: pin-init: internal: remove `allow` and `expect`s that don't fire rust: pin-init: remove redundant clippy expects in doc tests rust: pin-init: examples: fix incorrect drop rust: pin-init: internal: error on duplicate `#[pin]` attribute
2026-08-10Merge tag 'v7.2-rc7' into driver-core-nextDanilo Krummrich2498-7825/+15273
We need the driver-core fixes in here as well to build on top of. Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-08-09ovpn: defer key slot crypto freeing to workqueueRalf Lici4-16/+18
Key slots are released through a kref and the existing release path frees the AEAD transforms from an RCU callback. That is not safe for all crypto implementations: crypto_free_aead can sleep, for example when an async or hardware implementation has teardown work to complete. Use queue_rcu_work for key-slot release. This keeps the RCU grace period needed by lockless key-slot readers, but runs the actual crypto teardown from workqueue context where sleeping is allowed. Once the rcu_work callback runs, pre-existing RCU readers are gone, and the final kref put already proves that no transform user remains, so the worker can release the AEAD transforms and free the slot directly. The previous patch drains ovpn_wq during module exit, so queued key-slot teardown work cannot outlive module text. Fixes: 8534731dbf2d ("ovpn: implement packet processing") Signed-off-by: Ralf Lici <ralf@mandelbit.com> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-08-09ovpn: run deferred work on a module-owned workqueueRalf Lici4-10/+30
ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point that guarantees the callbacks have fully returned before the module text can be freed. Object references protect the objects used by the callbacks, but they do not prove that a workqueue function has returned. In particular, a worker can drop the final reference that unblocks device teardown while it is still executing ovpn code. Add a module-owned workqueue and queue all ovpn work items on it. During module exit, unregister rtnl and netlink first, flush the workqueue so ordinary ovpn workers finish, run the final RCU barrier, and destroy the workqueue last. This keeps the workqueue available for cleanup work queued from RCU callbacks, while ensuring no ovpn work item can outlive the module text. The per-device delayed keepalive work remains explicitly disabled during netdev teardown (disable_delayed_work_sync in ndo_uninit), since flush_workqueue does not flush delayed work that is still only pending on its timer. Fixes: 3ecfd9349f40 ("ovpn: implement keepalive mechanism") Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Signed-off-by: Ralf Lici <ralf@mandelbit.com> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-08-09gpio: ppc44x: use dev_name() for chip labelRosen Penev1-5/+1
Replace devm_kasprintf() with dev_name() for the chip label. dev_name() returns a stable pointer to the device name, so the separate allocation and -ENOMEM check can be dropped. Using dev_name() seems to be common for GPIO labels. Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260803223539.86303-9-rosenp@gmail.com
generated by cgit (git 2.54.0.dirty) at 2026-09-26 03:34:10 +0000