summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2025-06-24drm/amdgpu: fix slab-use-after-free in amdgpu_userq_mgr_fini+0x70cVitaly Prosyak2-15/+4
The issue was reproduced on NV10 using IGT pci_unplug test. It is expected that `amdgpu_driver_postclose_kms()` is called prior to `amdgpu_drm_release()`. However, the bug is that `amdgpu_fpriv` was freed in `amdgpu_driver_postclose_kms()`, and then later accessed in `amdgpu_drm_release()` via a call to `amdgpu_userq_mgr_fini()`. As a result, KASAN detected a use-after-free condition, as shown in the log below. The proposed fix is to move the calls to `amdgpu_eviction_fence_destroy()` and `amdgpu_userq_mgr_fini()` into `amdgpu_driver_postclose_kms()`, so they are invoked before `amdgpu_fpriv` is freed. This also ensures symmetry with the initialization path in `amdgpu_driver_open_kms()`, where the following components are initialized: - `amdgpu_userq_mgr_init()` - `amdgpu_eviction_fence_init()` - `amdgpu_ctx_mgr_init()` Correspondingly, in `amdgpu_driver_postclose_kms()` we should clean up using: - `amdgpu_userq_mgr_fini()` - `amdgpu_eviction_fence_destroy()` - `amdgpu_ctx_mgr_fini()` This change eliminates the use-after-free and improves consistency in resource management between open and close paths. [ +0.094367] ================================================================== [ +0.000026] BUG: KASAN: slab-use-after-free in amdgpu_userq_mgr_fini+0x70c/0x730 [amdgpu] [ +0.000866] Write of size 8 at addr ffff88811c068c60 by task amd_pci_unplug/1737 [ +0.000026] CPU: 3 UID: 0 PID: 1737 Comm: amd_pci_unplug Not tainted 6.14.0+ #2 [ +0.000008] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000004] Call Trace: [ +0.000004] <TASK> [ +0.000003] dump_stack_lvl+0x76/0xa0 [ +0.000010] print_report+0xce/0x600 [ +0.000009] ? amdgpu_userq_mgr_fini+0x70c/0x730 [amdgpu] [ +0.000790] ? srso_return_thunk+0x5/0x5f [ +0.000007] ? kasan_complete_mode_report_info+0x76/0x200 [ +0.000008] ? amdgpu_userq_mgr_fini+0x70c/0x730 [amdgpu] [ +0.000684] kasan_report+0xbe/0x110 [ +0.000007] ? amdgpu_userq_mgr_fini+0x70c/0x730 [amdgpu] [ +0.000601] __asan_report_store8_noabort+0x17/0x30 [ +0.000007] amdgpu_userq_mgr_fini+0x70c/0x730 [amdgpu] [ +0.000801] ? __pfx_amdgpu_userq_mgr_fini+0x10/0x10 [amdgpu] [ +0.000819] ? srso_return_thunk+0x5/0x5f [ +0.000008] amdgpu_drm_release+0xa3/0xe0 [amdgpu] [ +0.000604] __fput+0x354/0xa90 [ +0.000010] __fput_sync+0x59/0x80 [ +0.000005] __x64_sys_close+0x7d/0xe0 [ +0.000006] x64_sys_call+0x2505/0x26f0 [ +0.000006] do_syscall_64+0x7c/0x170 [ +0.000004] ? kasan_record_aux_stack+0xae/0xd0 [ +0.000005] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? kmem_cache_free+0x398/0x580 [ +0.000006] ? __fput+0x543/0xa90 [ +0.000006] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? __fput+0x543/0xa90 [ +0.000004] ? __kasan_check_read+0x11/0x20 [ +0.000007] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? __kasan_check_read+0x11/0x20 [ +0.000003] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? fpregs_assert_state_consistent+0x21/0xb0 [ +0.000006] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? syscall_exit_to_user_mode+0x4e/0x240 [ +0.000005] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? do_syscall_64+0x88/0x170 [ +0.000003] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? do_syscall_64+0x88/0x170 [ +0.000004] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? irqentry_exit+0x43/0x50 [ +0.000004] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? exc_page_fault+0x7c/0x110 [ +0.000006] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000005] RIP: 0033:0x7ffff7b14f67 [ +0.000005] Code: ff e8 0d 16 02 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 73 ba f7 ff [ +0.000004] RSP: 002b:00007fffffffe358 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ +0.000006] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffff7b14f67 [ +0.000003] RDX: 0000000000000000 RSI: 00007ffff7f5755a RDI: 0000000000000003 [ +0.000003] RBP: 00007fffffffe380 R08: 0000555555568170 R09: 0000000000000000 [ +0.000003] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffffffe5c8 [ +0.000003] R13: 00005555555552a9 R14: 0000555555557d48 R15: 00007ffff7ffd040 [ +0.000007] </TASK> [ +0.000286] Allocated by task 425 on cpu 11 at 29.751192s: [ +0.000013] kasan_save_stack+0x28/0x60 [ +0.000008] kasan_save_track+0x18/0x70 [ +0.000006] kasan_save_alloc_info+0x38/0x60 [ +0.000006] __kasan_kmalloc+0xc1/0xd0 [ +0.000005] __kmalloc_cache_noprof+0x1bd/0x430 [ +0.000006] amdgpu_driver_open_kms+0x172/0x760 [amdgpu] [ +0.000521] drm_file_alloc+0x569/0x9a0 [ +0.000008] drm_client_init+0x1b7/0x410 [ +0.000007] drm_fbdev_client_setup+0x174/0x470 [ +0.000007] drm_client_setup+0x8a/0xf0 [ +0.000006] amdgpu_pci_probe+0x50b/0x10d0 [amdgpu] [ +0.000482] local_pci_probe+0xe7/0x1b0 [ +0.000008] pci_device_probe+0x5bf/0x890 [ +0.000005] really_probe+0x1fd/0x950 [ +0.000007] __driver_probe_device+0x307/0x410 [ +0.000005] driver_probe_device+0x4e/0x150 [ +0.000006] __driver_attach+0x223/0x510 [ +0.000005] bus_for_each_dev+0x102/0x1a0 [ +0.000006] driver_attach+0x3d/0x60 [ +0.000005] bus_add_driver+0x309/0x650 [ +0.000005] driver_register+0x13d/0x490 [ +0.000006] __pci_register_driver+0x1ee/0x2b0 [ +0.000006] xfrm_ealg_get_byidx+0x43/0x50 [xfrm_algo] [ +0.000008] do_one_initcall+0x9c/0x3e0 [ +0.000007] do_init_module+0x29e/0x7f0 [ +0.000006] load_module+0x5c75/0x7c80 [ +0.000006] init_module_from_file+0x106/0x180 [ +0.000007] idempotent_init_module+0x377/0x740 [ +0.000006] __x64_sys_finit_module+0xd7/0x180 [ +0.000006] x64_sys_call+0x1f0b/0x26f0 [ +0.000006] do_syscall_64+0x7c/0x170 [ +0.000005] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000013] Freed by task 1737 on cpu 9 at 76.455063s: [ +0.000010] kasan_save_stack+0x28/0x60 [ +0.000006] kasan_save_track+0x18/0x70 [ +0.000005] kasan_save_free_info+0x3b/0x60 [ +0.000006] __kasan_slab_free+0x54/0x80 [ +0.000005] kfree+0x127/0x470 [ +0.000006] amdgpu_driver_postclose_kms+0x455/0x760 [amdgpu] [ +0.000485] drm_file_free.part.0+0x5b1/0xba0 [ +0.000007] drm_file_free+0x13/0x30 [ +0.000006] drm_client_release+0x1c4/0x2b0 [ +0.000006] drm_fbdev_ttm_fb_destroy+0xd2/0x120 [drm_ttm_helper] [ +0.000007] put_fb_info+0x97/0xe0 [ +0.000006] unregister_framebuffer+0x197/0x380 [ +0.000005] drm_fb_helper_unregister_info+0x94/0x100 [ +0.000005] drm_fbdev_client_unregister+0x3c/0x80 [ +0.000007] drm_client_dev_unregister+0x144/0x330 [ +0.000006] drm_dev_unregister+0x49/0x1b0 [ +0.000006] drm_dev_unplug+0x4c/0xd0 [ +0.000006] amdgpu_pci_remove+0x58/0x130 [amdgpu] [ +0.000482] pci_device_remove+0xae/0x1e0 [ +0.000006] device_remove+0xc7/0x180 [ +0.000006] device_release_driver_internal+0x3d4/0x5a0 [ +0.000007] device_release_driver+0x12/0x20 [ +0.000006] pci_stop_bus_device+0x104/0x150 [ +0.000006] pci_stop_and_remove_bus_device_locked+0x1b/0x40 [ +0.000005] remove_store+0xd7/0xf0 [ +0.000007] dev_attr_store+0x3f/0x80 [ +0.000006] sysfs_kf_write+0x125/0x1d0 [ +0.000005] kernfs_fop_write_iter+0x2ea/0x490 [ +0.000007] vfs_write+0x90d/0xe70 [ +0.000006] ksys_write+0x119/0x220 [ +0.000006] __x64_sys_write+0x72/0xc0 [ +0.000006] x64_sys_call+0x18ab/0x26f0 [ +0.000005] do_syscall_64+0x7c/0x170 [ +0.000005] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000013] The buggy address belongs to the object at ffff88811c068000 which belongs to the cache kmalloc-rnd-01-4k of size 4096 [ +0.000016] The buggy address is located 3168 bytes inside of freed 4096-byte region [ffff88811c068000, ffff88811c069000) [ +0.000022] The buggy address belongs to the physical page: [ +0.000010] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88811c06e000 pfn:0x11c068 [ +0.000006] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ +0.000006] flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) [ +0.000007] page_type: f5(slab) [ +0.000007] raw: 0017ffffc0000040 ffff88810004c140 dead000000000122 0000000000000000 [ +0.000005] raw: ffff88811c06e000 0000000080040002 00000000f5000000 0000000000000000 [ +0.000006] head: 0017ffffc0000040 ffff88810004c140 dead000000000122 0000000000000000 [ +0.000005] head: ffff88811c06e000 0000000080040002 00000000f5000000 0000000000000000 [ +0.000006] head: 0017ffffc0000003 ffffea0004701a01 ffffffffffffffff 0000000000000000 [ +0.000005] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ +0.000004] page dumped because: kasan: bad access detected [ +0.000011] Memory state around the buggy address: [ +0.000009] ffff88811c068b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000012] ffff88811c068b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000011] >ffff88811c068c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000011] ^ [ +0.000010] ffff88811c068c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000011] ffff88811c068d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000011] ================================================================== Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Christian König <christian.koenig@amd.com> Cc: Lijo Lazar <lijo.lazar@amd.com> Cc: Jesse Zhang <Jesse.Zhang@amd.com> Cc: Arvind Yadav <arvind.yadav@amd.com> v2: drop amdgpu_drm_release() and assign drm_release() as the callback directly.(Alex) Fixes: adba0929736a ("drm/amdgpu: Fix Illegal opcode in command stream Error") Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd: Add missing kdoc for amd_ip_funcs `complete` callbackMario Limonciello1-0/+1
The `complete` callback should be described in kernel doc. Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> Closes: https://lore.kernel.org/linux-next/20250619205931.41cf9332@canb.auug.org.au/ Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Link: https://lore.kernel.org/r/20250620041420.3585005-1-superm1@kernel.org Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amdgpu: remove fence slabAlex Deucher3-27/+4
Just use kmalloc for the fences in the rare case we need an independent fence. Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd: Adjust output for discovery error handlingMario Limonciello1-15/+13
commit 017fbb6690c2 ("drm/amdgpu/discovery: check ip_discovery fw file available") added support for reading an amdgpu IP discovery bin file for some specific products. If it's not found then it will fallback to hardcoded values. However if it's not found there is also a lot of noise about missing files and errors. Adjust the error handling to decrease most messages to DEBUG and to show users less about missing files. Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reported-by: Marcus Seyfarth <m.seyfarth@gmail.com> Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4312 Tested-by: Marcus Seyfarth <m.seyfarth@gmail.com> Fixes: 017fbb6690c2 ("drm/amdgpu/discovery: check ip_discovery fw file available") Acked-by: Alex Deucher <alexander.deucher@amd.com> Link: https://lore.kernel.org/r/20250617183052.1692059-1-superm1@kernel.org Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd/display: Promote DAL to 3.2.339Taimur Hassan1-1/+1
Summary: * Improve USB4 bandwidth validation * dml clock calcuation with EQU Prefetch included * Tweaking udelay time to fix "failed to blank crtc!" error * Add LSDMA support to DMUB * Fix Coverity issue Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Taimur Hassan <Syed.Hassan@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd/display: [FW Promotion] Release 0.1.16.0Taimur Hassan1-0/+3
Summary for changes in firmware: * Add DMCUB IPS commands and command parser support * use OTG count to disable interrupts * Fix dmub_cmd header data boundary issue * remove the HW register override Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Taimur Hassan <Syed.Hassan@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd/display: Add DMUB IPS command support for IPS residency toolsOvidiu Bunea4-114/+132
[why & how] Add DMUB IPS CMD interface for driver and DMU to communicate for IPS residency tools. Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> Signed-off-by: Ovidiu Bunea <Ovidiu.Bunea@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd/display: Add num_slices_h to set_dto_dscclk signatureIlya Bakoulin5-8/+9
Add the number of horizontal slices argument to allow configuring clock based on slice number. Reviewed-by: Nevenko Stupar <nevenko.stupar@amd.com> Signed-off-by: Ilya Bakoulin <Ilya.Bakoulin@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd/display: DML21 ReintegrationAustin Zheng8-24/+248
Update logging macros for detailed debugging Update structs to contain more detailed information Add HDMI 16 and 20 Gbps rates Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Austin Zheng <Austin.Zheng@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd/display: Rewording Mode Validation ResultFangzhi Zuo1-1/+1
It is normal to prune resolutions that exceed hw or bw limitation. Use error oriented wordings could cause misunderstanding. Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd/display: LSDMA supportOstrowski Rafal4-0/+260
[Why] Driver should be able to send LSDMA commands to DMCUB [How] Driver can now send LSDMA commands to DMCUB. DMCUB should process them and send to LSDMA controller. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Ostrowski Rafal <rostrows@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd/display: Remove redundant macro of refresh rateWeiguang Li1-1/+1
[Why&How] Found that we add redundant macro on refresh rate when calculating vtotal, so we remove it. Reviewed-by: Robin Chen <robin.chen@amd.com> Signed-off-by: Weiguang Li <wei-guang.li@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd/display: Fix 'failed to blank crtc!'Wen Chen1-1/+1
[why] DCN35 is having “DC: failed to blank crtc!” when running HPO test cases. It's caused by not having sufficient udelay time. [how] Replace the old wait_for_blank_complete function with fsleep function to sleep just until the next frame should come up. This way it doesn't poll in case the pixel clock or other clock was bugged or until vactive and the vblank are hit again. Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> Signed-off-by: Wen Chen <Wen.Chen3@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd/display: Initialize mode_select to 0Alex Hung1-1/+1
[WHAT] mode_select was supposed to be initialized in mpc_read_gamut_remap but is not set in default case. This can cause indeterminate behaviors. This is reported as an UNINIT error by Coverity. Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd/display: Add new DP tunnel bandwidth validationCruise Hung14-52/+302
[Why & How] Add new function for DP tunnel bandwidth validation. It uses the estimated BW and allocated BW to validate the timings. Reviewed-by: PeiChen Huang <peichen.huang@amd.com> Reviewed-by: Meenakshikumar Somasundaram <meenakshikumar.somasundaram@amd.com> Signed-off-by: Cruise Hung <Cruise.Hung@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd/display: Removed unnecessary commentAlvin Lee1-1/+0
Reviewed-by: Sridevi Arvindekar <sridevi.arvindekar@amd.com> Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd/display: Include EQU Prefetch Bandwidth For Bandwidth CalculationsAustin Zheng2-23/+35
[Why] Pixel data bandwidth required in mode programming (MP) ends up being higher than what was calculated in mode support (MS) even though the prefetch bandwidths calculated in MP are lower than the MS ones. MP used a different equ prefetch schedule than MS which lead a slight difference in parameters. This resulted in the pixel data bandwidth in MP to be higher than MS. [How] Rename the RequiredPrefetchBWOTO term so it can be applied generically. Update the value with the EQU bandwidth if the EQU schedule is used. Get the max prefetch bandwidth that MS calculated and use it as part of the calculations for required bandwidth. Reviewed-by: Dillon Varone <dillon.varone@amd.com> Signed-off-by: Austin Zheng <Austin.Zheng@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amd/pm: Fetch SMUv13.0.6 xgmi max speed/widthLijo Lazar1-0/+5
On SMUv13.0.6 SOCs, fetch the max values of xgmi speed/width from firmware. Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24power: sequencing: Add T-HEAD TH1520 GPU power sequencer driverMichal Wilczynski3-0/+256
Introduce the pwrseq-thead-gpu driver, a power sequencer provider for the Imagination BXM-4-64 GPU on the T-HEAD TH1520 SoC. This driver controls an auxiliary device instantiated by the AON power domain. The TH1520 GPU requires a specific sequence to correctly initialize and power down its resources: - Enable GPU clocks (core and sys). - De-assert the GPU clock generator reset (clkgen_reset). - Introduce a short hardware-required delay. - De-assert the GPU core reset. The power-down sequence performs these steps in reverse. Implement this sequence via the pwrseq_power_on and pwrseq_power_off callbacks. Crucially, the driver's match function is called when a consumer (the Imagination GPU driver) requests the "gpu-power" target. During this match, the sequencer uses clk_bulk_get() and reset_control_get_exclusive() on the consumer's device to obtain handles to the GPU's "core" and "sys" clocks, and the GPU core reset. These, along with clkgen_reset obtained from parent aon node, allow it to perform the complete sequence. Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com> Link: https://lore.kernel.org/r/20250623-apr_14_for_sending-v6-1-6583ce0f6c25@samsung.com [Bartosz: use a ternary operator instead of implicitly casting the result of a boolean expression to int] Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-06-24drm/amdgpu/mes: add compatibility checks for set_hw_resource_1Alex Deucher2-5/+8
Seems some older MES firmware versions do not properly support this packet. Add back some the compatibility checks. v2: switch to fw version check (Shaoyun) Fixes: f81cd793119e ("drm/amd/amdgpu: Fix MES init sequence") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4295 Cc: Shaoyun Liu <shaoyun.liu@amd.com> Reviewed-by: shaoyun.liu <shaoyun.liu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24drm/amdgpu/gfx9: Add Cleaner Shader Support for GFX9.x GPUsSrinivasan Shanmugam1-0/+19
Enable the cleaner shader for other GFX9.x series of GPUs to provide data isolation between GPU workloads. The cleaner shader is responsible for clearing the Local Data Store (LDS), Vector General Purpose Registers (VGPRs), and Scalar General Purpose Registers (SGPRs), which helps prevent data leakage and ensures accurate computation results. This update extends cleaner shader support to GFX9.x GPUs, previously available for GFX9.4.2. It enhances security by clearing GPU memory between processes and maintains a consistent GPU state across KGD and KFD workloads. Cc: Manu Rastogi <manu.rastogi@amd.com> Cc: Christian König <christian.koenig@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2025-06-24wifi: cfg80211/mac80211: Add support to get radio indexRoopni Devanathan74-157/+259
Currently, per-radio attributes are set on per-phy basis, i.e., all the radios present in a wiphy will take attributes values sent from user. But each radio in a wiphy can get different values from userspace based on its requirement. To extend support to set per-radio attributes, add support to get radio index from userspace. Add an NL attribute - NL80211_ATTR_WIPHY_RADIO_INDEX, to get user specified radio index for which attributes should be changed. Pass this to individual drivers, so that the drivers can use this radio index to change per-radio attributes when necessary. Currently, per-radio attributes identified are: NL80211_ATTR_WIPHY_TX_POWER_LEVEL NL80211_ATTR_WIPHY_ANTENNA_TX NL80211_ATTR_WIPHY_ANTENNA_RX NL80211_ATTR_WIPHY_RETRY_SHORT NL80211_ATTR_WIPHY_RETRY_LONG NL80211_ATTR_WIPHY_FRAG_THRESHOLD NL80211_ATTR_WIPHY_RTS_THRESHOLD NL80211_ATTR_WIPHY_COVERAGE_CLASS NL80211_ATTR_TXQ_LIMIT NL80211_ATTR_TXQ_MEMORY_LIMIT NL80211_ATTR_TXQ_QUANTUM By default, the radio index is set to -1. This means the attribute should be treated as a global configuration. If the user has not specified any index, then the radio index passed to individual drivers would be -1. This would indicate that the attribute applies to all radios in that wiphy. Signed-off-by: Roopni Devanathan <quic_rdevanat@quicinc.com> Link: https://patch.msgid.link/20250615082312.619639-2-quic_rdevanat@quicinc.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-06-24wifi: mac80211: add support towards MLO handling of station statisticsSarika Sharma1-1/+1
Currently, in supporting API's to fill sinfo structure from sta structure, is mapped to fill the fields from sta->deflink. However, for multi-link (ML) station, sinfo structure should be filled from corresponding link_id. Therefore, add link_id as an additional argument in supporting API's for filling sinfo structure correctly. Link_id is set to -1 for non-ML station and corresponding link_id for ML stations. In supporting API's for filling sinfo structure, check for link_id, if link_id < 0, fill the sinfo structure from sta->deflink, otherwise fill from sta->link[link_id]. Current, changes are done at the deflink level i.e, pass -1 as link_id. Actual link_id will be added in subsequent patches to support station statistics for MLO. Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com> Link: https://patch.msgid.link/20250528054420.3050133-2-quic_sarishar@quicinc.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-06-24mmc: Merge branch fixes into nextUlf Hansson1-7/+2
Merge the mmc fixes for v6.16-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.17. Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24Revert "mmc: sdhci: Disable SD card clock before changing parameters"Ulf Hansson1-7/+2
It has turned out the trying to strictly conform to the SDHCI specification is causing problems. Let's revert and start over. This reverts commit fb3bbc46c94f261b6156ee863c1b06c84cf157dc. Cc: Erick Shepherd <erick.shepherd@ni.com> Cc: stable@vger.kernel.org Fixes: fb3bbc46c94f ("mmc: sdhci: Disable SD card clock before changing parameters") Suggested-by: Adrian Hunter <adrian.hunter@intel.com> Reported-by: Jonathan Liu <net147@gmail.com> Reported-by: Salvatore Bonaccorso <carnil@debian.org> Closes: https://bugs.debian.org/1108065 Acked-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Link: https://lore.kernel.org/r/20250624110932.176925-1-ulf.hansson@linaro.org
2025-06-24spi: spi-pci1xxxx: Add support for per-instance DMA interrupt vectorsThangaraj Samynathan1-68/+144
Add support for dedicated DMA interrupt vectors for each SPI hardware instance in the pci1xxxx driver. This improves scalability and interrupt handling for systems using multiple SPI instances with DMA. Introduce a constant `NUM_VEC_PER_INST` to define the number of IRQ vectors per instance (main, DMA write, DMA read). Update the `pci1xxxx_spi_internal` structure to use an IRQ array. Refactor IRQ allocation and DMA initialization logic: - Assign separate IRQ vectors for DMA read and write interrupts. - Split the original DMA ISR into two handlers: `pci1xxxx_spi_isr_dma_rd` and `pci1xxxx_spi_isr_dma_wr`. - Configure IMWR registers per instance using cached MSI data. - Move DMA register configuration into a new helper function, `pci1xxxx_spi_dma_config()`. Invoke the DMA initialization after all instances are configured to ensure correct IRQ vector mapping. Signed-off-by: Thangaraj Samynathan <thangaraj.s@microchip.com> Link: https://patch.msgid.link/20250624033028.74389-1-thangaraj.s@microchip.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-06-24mmc: Merge branch fixes into nextUlf Hansson6-21/+54
Merge the mmc fixes for v6.16-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.17. Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: sdhci-cadence: add Mobileye eyeQ supportBenoît Monin1-0/+11
The MMC/SDHCI controller implemented by Mobileye needs the preset value quirks to configure the clock properly at speed slower than HS200. It otherwise works as a standard sd4hc controller. Signed-off-by: Benoît Monin <benoit.monin@bootlin.com> Link: https://lore.kernel.org/r/e97f409650495791e07484589e1666ead570fa12.1750156323.git.benoit.monin@bootlin.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: rtsx_usb_sdmmc: Fix clang -Wimplicit-fallthrough in sd_set_power_mode()Nathan Chancellor1-0/+2
Clang warns (or errors with CONFIG_WERROR=y): drivers/mmc/host/rtsx_usb_sdmmc.c:1042:2: error: unannotated fall-through between switch labels [-Werror,-Wimplicit-fallthrough] 1042 | case MMC_POWER_UNDEFINED: | ^ drivers/mmc/host/rtsx_usb_sdmmc.c:1042:2: note: insert 'break;' to avoid fall-through 1042 | case MMC_POWER_UNDEFINED: | ^ | break; Clang is a little more pedantic than GCC, which does not warn when falling through to a case that is just break or return. Clang's version is more in line with the kernel's own stance in deprecated.rst, which states that all switch/case blocks must end in either break, fallthrough, continue, goto, or return. Add the missing break to silence the warning. Fixes: 2c3809bd6f65 ("mmc: rtsx_usb_sdmmc: Add 74 clocks in poweron flow") Signed-off-by: Nathan Chancellor <nathan@kernel.org> Link: https://lore.kernel.org/r/20250620-mmc-rtsx-usb-sdmmc-fix-clang-implicit-fallthrough-v1-1-4031d11159c0@kernel.org Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: cb710-mmc: Convert ternary operator to str_plural() helperLi Dong1-1/+2
Replace direct ternary condition check with existing helper function str_plural() to improve code readability and maintain consistency. Signed-off-by: Li Dong <lidong@vivo.com> Link: https://lore.kernel.org/r/20250618115954.10260-1-lidong@vivo.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: rtsx_usb_sdmmc: Add 74 clocks in poweron flowRicky Wu1-0/+5
To conform with SD spec definition, that the host must provide at least 74 clocks before issuing first command, let's add these clock cycles at MMC_POWER_UP. Signed-off-by: Ricky Wu <ricky_wu@realtek.com> Link: https://lore.kernel.org/r/20250616064956.1846258-1-ricky_wu@realtek.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: rtsx_usb_sdmmc: Re-work the code in sd_set_power_mode()Ulf Hansson1-5/+13
It's only at MMC_POWER_OFF and at MMC_POWER_UP when some operations must be carried out in sd_set_power_mode(). The code is a bit obfuscated in this regards. Let's convert it into a switch-case-clause to make this clear. Reviewed-by: Avri Altman <avri.altman@sandisk.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Acked-by: Ricky Wu <ricky_wu@realtek.com> Link: https://lore.kernel.org/r/20250610111633.504366-5-ulf.hansson@linaro.org
2025-06-24mmc: rtsx_usb_sdmmc: Convert sd_set_power_mode() into voidUlf Hansson1-3/+2
The sdmmc_set_ios() is the only caller of sd_set_power_mode() and it ignores the return code. Let's therefore convert sd_set_power_mode() into a void function instead. Reviewed-by: Avri Altman <avri.altman@sandisk.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Acked-by: Ricky Wu <ricky_wu@realtek.com> Link: https://lore.kernel.org/r/20250610111633.504366-4-ulf.hansson@linaro.org
2025-06-24mmc: rtsx_usb_sdmmc: Print debug-messages at power-on/off errorsUlf Hansson1-0/+4
It should be useful to know when we fail to power-on/off a card. Let's therefore print debug-messages when this happens. Reviewed-by: Avri Altman <avri.altman@sandisk.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Acked-by: Ricky Wu <ricky_wu@realtek.com> Link: https://lore.kernel.org/r/20250610111633.504366-3-ulf.hansson@linaro.org
2025-06-24mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()Ulf Hansson1-3/+1
In the error path of sd_set_power_mode() we don't update host->power_mode, which could lead to an imbalance of the runtime PM usage count. Fix this by always updating host->power_mode. Reviewed-by: Avri Altman <avri.altman@sandisk.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Acked-by: Ricky Wu <ricky_wu@realtek.com> Link: https://lore.kernel.org/r/20250610111633.504366-2-ulf.hansson@linaro.org
2025-06-24mmc: host: renesas_sdhi: Fix incorrect auto retuning for an SDIO cardYoshihiro Shimoda2-7/+42
This host controller is possible to change incorrect tap if an SDIO card is used because DAT1 is used for interrupt signal on SDIO standard but the controller doesn't take care of it. So, in the worst case, this behavior causes a CRC error. To resolve the issue, this driver uses manual correction mode instead of auto correction if an SDIO card is used. Also, even if DAT1 is mismatched on an SDIO card, this driver will not change the TAP. Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://lore.kernel.org/r/20250610072545.2001435-3-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: host: tmio: Add .sdio_irq()Yoshihiro Shimoda2-1/+5
Renesas SDHI controller requires vender specific handling when an SDIO irq occurs. So, add .sdio_irq() to the tmio core. Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://lore.kernel.org/r/20250610072545.2001435-2-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: sdhci: Drop sdhci_free_host()/sdhci_pltfm_free() interfaceBinbin Zhou4-13/+0
>From now on, all calls to sdhci_free_host()/sdhci_pltfm_free() have been cleaned up, so we can just delete them. Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Link: https://lore.kernel.org/r/8adcfef00fd4bc40f33f5fd42d2e5e73d72e68e4.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: sdhci_f_sdh30: Drop the use of sdhci_pltfm_free()Binbin Zhou1-9/+4
Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Link: https://lore.kernel.org/r/c216c46cb5aebe8e4598215428ace4440974c188.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: sdhci_am654: Drop the use of sdhci_pltfm_free()Binbin Zhou1-14/+6
Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Link: https://lore.kernel.org/r/a456963bae14b0c6dade02f388f815f1ffcaa98a.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: sdhci-xenon: Drop the use of sdhci_pltfm_free()Binbin Zhou1-10/+5
Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Hu Ziji <huziji@marvell.com> Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Link: https://lore.kernel.org/r/e7c52155f04fc270400985b70514800c23fd5565.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: sdhci-tegra: Drop the use of sdhci_pltfm_free()Binbin Zhou1-6/+3
Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Thierry Reding <thierry.reding@gmail.com> Cc: Jonathan Hunter <jonathanh@nvidia.com> Cc: linux-tegra@vger.kernel.org Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Acked-by: Thierry Reding <treding@nvidia.com> Link: https://lore.kernel.org/r/cee82eaad0392838fbe1fab8e2301e680d34c0c5.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: sdhci-st: Drop the use of sdhci_pltfm_free()Binbin Zhou1-4/+2
Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Patrice Chotard <patrice.chotard@foss.st.com> Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Link: https://lore.kernel.org/r/5fdb2403bf553ad43e2336d072007dd7ea2b4143.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: sdhci-sprd: Drop the use of sdhci_pltfm_free()Binbin Zhou1-23/+10
Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Orson Zhai <orsonzhai@gmail.com> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Reviewed-by: Chunyan Zhang <zhang.lyra@gmail.com> Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Link: https://lore.kernel.org/r/88a24d5f60bc916712cca813e24ae49b7e691eb2.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: sdhci-pxav3: Drop the use of sdhci_pltfm_free()Binbin Zhou1-6/+1
Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Link: https://lore.kernel.org/r/7b489e7326349c3709caa33efb0e995b5667fb27.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: sdhci-pxav2: Drop the use of sdhci_pltfm_free()Binbin Zhou1-20/+6
Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Link: https://lore.kernel.org/r/b4f833b5f4816cfe5b9e502d55aad6a970042aad.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: sdhci-pic32: Drop the use of sdhci_pltfm_free()Binbin Zhou1-6/+3
Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Link: https://lore.kernel.org/r/e6f16e97f8b82ffa71b8ad34e32e42ab240734e5.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: sdhci-omap: Drop the use of sdhci_pltfm_free()Binbin Zhou1-14/+7
Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Vignesh Raghavendra <vigneshr@ti.com> Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Link: https://lore.kernel.org/r/c45dd3f283de7e259cc2fa01ee8d1e34d18829d3.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: sdhci-of-sparx5: Drop the use of sdhci_pltfm_free()Binbin Zhou1-16/+8
Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Steen Hegelund <Steen.Hegelund@microchip.com> Cc: Daniel Machon <daniel.machon@microchip.com> Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Acked-by: Daniel Machon <daniel.machon@microchip.com> Link: https://lore.kernel.org/r/67b5e9076056da66d9fc8951fafd4f48ddd3ca25.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-06-24mmc: sdhci-of-ma35d1: Drop the use of sdhci_pltfm_free()Binbin Zhou1-15/+8
Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Jacky Huang <ychuang3@nuvoton.com> Cc: Shan-Chun Hung <schung@nuvoton.com> Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Link: https://lore.kernel.org/r/67a2a3b35e2d46aab06657e88566c14a7f2d7947.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
generated by cgit v1.2.3 (git 2.39.0) at 2026-06-07 01:42:04 +0300