kernel/linux.git/drivers/dma/idxd/init.c, branch linux-7.0.y

dmaengine: idxd: Fix possible invalid memory access after FLR

2026-02-25T11:09:17+00:00

In the case that the first Function Level Reset (FLR) concludes correctly, but in the second FLR the scratch area for the saved configuration cannot be allocated, it's possible for a invalid memory access to happen. Always set the deallocated scratch area to NULL after FLR completes. Fixes: 98d187a98903 ("dmaengine: idxd: Enable Function Level Reset (FLR) for halt") Reviewed-by: Dave Jiang Signed-off-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-3-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul

dmaengine: idxd: Fix crash when the event log is disabled

2026-02-25T11:09:17+00:00

If reporting errors to the event log is not supported by the hardware, and an error that causes Function Level Reset (FLR) is received, the driver will try to restore the event log even if it was not allocated. Also, only try to free the event log if it was properly allocated. Fixes: 6078a315aec1 ("dmaengine: idxd: Add idxd_device_config_save() and idxd_device_config_restore() helpers") Reviewed-by: Dave Jiang Signed-off-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-2-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul

dmaengine: idxd: Fix lockdep warnings when calling idxd_device_config()

2026-02-25T11:09:17+00:00

Move the check for IDXD_FLAG_CONFIGURABLE and the locking to "inside" idxd_device_config(), as this is common to all callers, and the one that wasn't holding the lock was an error (that was causing the lockdep warning). Suggested-by: Dave Jiang Reviewed-by: Dave Jiang Signed-off-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-1-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul

dmaengine: idxd: Add Max SGL Size Support for DSA3.0

2026-01-09T03:06:00+00:00

Certain DSA 3.0 opcodes, such as Gather copy and Gather reduce, require max SGL configured for workqueues prior to supporting these opcodes. Configure the maximum scatter-gather list (SGL) size for workqueues during setup on the supported HW. Application can then properly handle the SGL size without explicitly setting it. Signed-off-by: Yi Sun Co-developed-by: Anil S Keshavamurthy Signed-off-by: Anil S Keshavamurthy Reviewed-by: Dave Jiang Tested-by: Yi Lai Acked-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260107-idxd-yi-sun-dsa3-sgl-size-v2-2-dbef8f559e48@intel.com Signed-off-by: Vinod Koul

dmaengine: idxd: Expose DSA3.0 capabilities through sysfs

2026-01-09T03:06:00+00:00

Introduce sysfs interfaces for 3 new Data Streaming Accelerator (DSA) capability registers (dsacap0-2) to enable userspace awareness of hardware features in DSA version 3 and later devices. Userspace components (e.g. configure libraries, workload Apps) require this information to: 1. Select optimal data transfer strategies based on SGL capabilities 2. Enable hardware-specific optimizations for floating-point operations 3. Configure memory operations with proper numerical handling 4. Verify compute operation compatibility before submitting jobs The output format is ,,, where each DSA capability value is a 64-bit hexadecimal number, separated by commas. The ordering follows the DSA 3.0 specification layout: Offset: 0x190 0x188 0x180 Reg: dsacap2 dsacap1 dsacap0 Example: cat /sys/bus/dsa/devices/dsa0/dsacaps 000000000000f18d,0014000e000007aa,00fa01ff01ff03ff According to the DSA 3.0 specification, there are 15 fields defined for the three dsacap registers. However, there's no need to define all register structures unless a use case requires them. At this point, support for the Scatter-Gather List (SGL) located in dsacap0 is necessary, so only dsacap0 is defined accordingly. For reference, the DSA 3.0 specification is available at: Link: https://software.intel.com/content/www/us/en/develop/articles/intel-data-streaming-accelerator-architecture-specification.html Signed-off-by: Yi Sun Co-developed-by: Anil S Keshavamurthy Signed-off-by: Anil S Keshavamurthy Reviewed-by: Dave Jiang Tested-by: Yi Lai Acked-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260107-idxd-yi-sun-dsa3-sgl-size-v2-1-dbef8f559e48@intel.com Signed-off-by: Vinod Koul

Merge tag 'dmaengine-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine

2025-10-06T17:37:06+00:00

Pull dmaengine updates from Vinod Koul: "A couple of new device support and small driver updates for this round. New support: - Intel idxd Wildcat Lake family support - SpacemiT K1 PDMA controller support - Renesas RZ/G3E family support Updates: - Xilinx shutdown support and dma client properties update - Designware edma callback_result support" * tag 'dmaengine-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dt-bindings: dma: rz-dmac: Document RZ/G3E family of SoCs dmaengine: dw-edma: Set status for callback_result dmaengine: mv_xor: match alloc_wc and free_wc dmaengine: mmp_pdma: Add SpacemiT K1 PDMA support with 64-bit addressing dmaengine: mmp_pdma: Add operations structure for controller abstraction dmaengine: mmp_pdma: Add reset controller support dmaengine: mmp_pdma: Add clock support dt-bindings: dma: Add SpacemiT K1 PDMA controller dt-bindings: dmaengine: xilinx_dma: Remove DMA client properties dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation dmaengine: xilinx_dma: Support descriptor setup from dma_vecs dmaengine: sh: setup_xref error handling dmaengine: Replace zero-length array with flexible-array dmaengine: ppc4xx: Remove space before newline dmaengine: idxd: Add a new IAA device ID for Wildcat Lake family platforms dmaengine: idxd: Replace memset(0) + strscpy() with strscpy_pad() dt-bindings: dma: nvidia,tegra20-apbdma: Add undocumented compatibles and "clock-names" dmaengine: zynqmp_dma: Add shutdown operation support

dmaengine: idxd: Add a new IAA device ID for Wildcat Lake family platforms

2025-08-20T17:34:14+00:00

A new IAA device ID, 0xfd2d, is introduced across all Wildcat Lake family platforms. Add the device ID to the IDXD driver. Signed-off-by: Anil S Keshavamurthy Signed-off-by: Vinicius Costa Gomes Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20250801215936.188555-1-vinicius.gomes@intel.com Signed-off-by: Vinod Koul

dmaengine: idxd: Fix double free in idxd_setup_wqs()

2025-08-20T17:32:04+00:00

The clean up in idxd_setup_wqs() has had a couple bugs because the error handling is a bit subtle. It's simpler to just re-write it in a cleaner way. The issues here are: 1) If "idxd->max_wqs" is <= 0 then we call put_device(conf_dev) when "conf_dev" hasn't been initialized. 2) If kzalloc_node() fails then again "conf_dev" is invalid. It's either uninitialized or it points to the "conf_dev" from the previous iteration so it leads to a double free. It's better to free partial loop iterations within the loop and then the unwinding at the end can handle whole loop iterations. I also renamed the labels to describe what the goto does and not where the goto was located. Fixes: 3fd2f4bc010c ("dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs") Reported-by: Colin Ian King Closes: https://lore.kernel.org/all/20250811095836.1642093-1-colin.i.king@gmail.com/ Signed-off-by: Dan Carpenter Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/aJnJW3iYTDDCj9sk@stanley.mountain Signed-off-by: Vinod Koul

dmaengine: idxd: Fix refcount underflow on module unload

2025-08-20T17:29:58+00:00

A recent refactor introduced a misplaced put_device() call, resulting in a reference count underflow during module unload. There is no need to add additional put_device() calls for idxd groups, engines, or workqueues. Although the commit claims: "Note, this also fixes the missing put_device() for idxd groups, engines, and wqs." It appears no such omission actually existed. The required cleanup is already handled by the call chain: idxd_unregister_devices() -> device_unregister() -> put_device() Extend idxd_cleanup() to handle the remaining necessary cleanup and remove idxd_cleanup_internals(), which duplicates deallocation logic for idxd, engines, groups, and workqueues. Memory management is also properly handled through the Linux device model. Fixes: a409e919ca32 ("dmaengine: idxd: Refactor remove call with idxd_cleanup() helper") Signed-off-by: Yi Sun Tested-by: Shuai Xue Reviewed-by: Dave Jiang Acked-by: Vinicius Costa Gomes Link: https://lore.kernel.org/r/20250729150313.1934101-3-yi.sun@intel.com Signed-off-by: Vinod Koul

dmaengine: idxd: Remove improper idxd_free

2025-08-20T17:29:58+00:00

The call to idxd_free() introduces a duplicate put_device() leading to a reference count underflow: refcount_t: underflow; use-after-free. WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 ... Call Trace: idxd_remove+0xe4/0x120 [idxd] pci_device_remove+0x3f/0xb0 device_release_driver_internal+0x197/0x200 driver_detach+0x48/0x90 bus_remove_driver+0x74/0xf0 pci_unregister_driver+0x2e/0xb0 idxd_exit_module+0x34/0x7a0 [idxd] __do_sys_delete_module.constprop.0+0x183/0x280 do_syscall_64+0x54/0xd70 entry_SYSCALL_64_after_hwframe+0x76/0x7e The idxd_unregister_devices() which is invoked at the very beginning of idxd_remove(), already takes care of the necessary put_device() through the following call path: idxd_unregister_devices() -> device_unregister() -> put_device() In addition, when CONFIG_DEBUG_KOBJECT_RELEASE is enabled, put_device() may trigger asynchronous cleanup via schedule_delayed_work(). If idxd_free() is called immediately after, it can result in a use-after-free. Remove the improper idxd_free() to avoid both the refcount underflow and potential memory corruption during module unload. Fixes: d5449ff1b04d ("dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call") Signed-off-by: Yi Sun Tested-by: Shuai Xue Reviewed-by: Dave Jiang Acked-by: Vinicius Costa Gomes Link: https://lore.kernel.org/r/20250729150313.1934101-2-yi.sun@intel.com Signed-off-by: Vinod Koul