Commit graph

1,462,193 commits

Author SHA1 Message Date
Vladimir Zapolskiy
c740532de0 dt-bindings: mmc: arm,pl18x: Do not use plural form of a proper noun PrimeCell
As a proper noun PrimeCell is a single entity and it can not have a plural
form, fix the typo.

Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Krzysztof Kozlowski
6fba00c98e mmc: sdhci-of-aspeed: Simplify with scoped for each OF child loop
Use scoped for-each loop when iterating over device nodes to make code a
bit simpler.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Krzysztof Kozlowski
f6b3889812 mmc: jz4740: Fix Wvoid-pointer-to-enum-cast warning
"jz4740" is an enum, thus cast of pointer on 64-bit compile test with
clang W=1 causes:

  jz4740_mmc.c:1055:18: error: cast to smaller integer type 'enum jz4740_mmc_version' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Krzysztof Kozlowski
4e709d5d62 mmc: cavium-octeon: Simplify with scoped for each OF child loop
Use scoped for-each loop when iterating over device nodes to make code a
bit simpler.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Krzysztof Kozlowski
e8c23b466b mmc: atmel-mci: Simplify with scoped for each OF child loop
Use scoped for-each loop when iterating over device nodes to make code a
bit simpler.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Thorsten Blum
0621d52b1d mmc: cavium: Use clamp to simplify cvm_mmc_set_clock
Use clamp() to simplify cvm_mmc_set_clock() and improve its readability.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Yixun Lan
658b716c04 mmc: sdhci-of-k1: add reset support
The SDHCI controller of SpacemiT K1 SoC requires two resets, add
support to explicitly request the reset line and deassert during
initialization phase. Still using devm_xx_get_optional() API to
make the request optional.

Signed-off-by: Yixun Lan <dlan@gentoo.org>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Yixun Lan
4231325cfb dt-bindings: mmc: spacemit,sdhci: add reset support
The SpacemiT SDHCI controller has two reset lines, one connect to AXI bus
which shared by all controllers, while another one connect to individual
controller separately.

Signed-off-by: Yixun Lan <dlan@gentoo.org>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Shawn Lin
5e9f849d8d mmc: dw_mmc: Remove struct dw_mci_slot
Use dw_mci_alloc_host() helper to allocate struct dw_mci for dw_mmc-pci.c
and dw_mmc-pltfm.c. With that, we could get rid of struct dw_mci_slot and
remove it everywhere.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Shawn Lin
c72be4c306 mmc: dw_mmc: Introduce dw_mci_alloc_host()
This helper is used for variant drivers to allocate struct dw_mci
and set struct dw_mci as private data of struct mmc_host.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Shawn Lin
3449b31eb1 mmc: dw_mmc: Remove queue from dw_mci
It's pointless to use a queue if only one slot is supported.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Shawn Lin
78983c4d60 mmc: dw_mmc: Remove mrq from struct dw_mci_slot
struct dw_mci has already kept mrq, so removing keeping mrq again from
struct dw_mci_slot.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Shawn Lin
027e1688bc mmc: dw_mmc: Move clock rate stuff from struct dw_mci_slot to struct dw_mci
Except for moving them, this patch also renames __clk_old to clk_old.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Shawn Lin
a151329009 mmc: dw_mmc: Remove sdio_id from struct dw_mci_slot
There is only one slot support, the sdio_id is used to indicate the SDIO
slot and where is the irq located. So it's pointless now, remove it. Given
sdio_id0 is only used by Rockchip to inform dwc core the irq is located
with a offset, rename sdio_id0 to sdio_irq to reflect the fact.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Shawn Lin
b8cc1e8066 mmc: dw_mmc: Remove id and ctype from dw_mci_slot
There is only one slot support, id should be zero. So no need
to keep it in track as long as ctype associated.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Shawn Lin
1a1936f808 mmc: dw_mmc: Move flags from struct dw_mci_slot to struct dw_mci
With this, dw_mmc-exynos.c will not need to access slot. While at it, since
the host->slot is always present when calling
dw_mci_exynos_set_clksel_timing(), let's remove it.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Shawn Lin
d7ab40c3bd mmc: dw_mmc: Let variant drivers to use struct dw_mci as possible
This patch changes the callbacks of switch_voltage() and execute_tuning()
in order for variant drivers to avoid accessing to struct dw_mci_slot.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Shawn Lin
1a990def44 mmc: dw_mmc: Move struct mmc_host from struct dw_mci_slot to struct dw_mci
Move struct mmc_host to struct dw_mci in preparation for removing dw_mci_slot.
No functional change intended.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:53 +01:00
Shawn Lin
53f05821b7 mmc: dw_mmc: Remove unused header files and keep alphabetical order
Some header files are not needed and they are out of order, this patch
remove unused header files and re-order them alphabetically.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:52 +01:00
Shawn Lin
9edf45987d mmc: dw_mmc: Remove check before calling mmc_regulator_set_ocr()
mmc_regulator_set_ocr() already checks if vqmmc is correct.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:52 +01:00
Shawn Lin
9313c6c3db mmc: dw_mmc: Remove vqmmc_enabled from struct dw_mci and update the reset
commit 51da224090 ("mmc: dw_mmc: use mmc_regulator_get_supply to handle regulators")
introduced tracking of vqmmc_enabled. Currently, mmc_regulator_enable_vqmmc()
and mmc_regulator_disable_vqmmc() well record the status of vqmmc, so use
these two helpers to remove vqmmc_enabled locally. With vqmmc_enabled gone,
resetting controller on MMC_POWER_ON phase won't work as dw_mci_set_ios()
will be called several times during enumerating which leads to reset the
controller several times too. This messes up the status machine of controller.

By looking into the commit d1f1dd8600 ("mmc: dw_mmc: Give a good reset
after we give power"), it tried to solve failures on rk3288. The problem
is probably because the vqmmc is used for IO block associated with dw
controller. When SD is removed during I/O, cutting off vqmmc in MMC_POWER_OFF
phase will confuse the controller as its status machine refers to several
IO status, such as data_state_mc_busy and data_busy on SDMMC_STATUS reg.
So the controller could run into an unexpected state and could not enumerate
cards correctly the next time. Reset it on MMC_POWER_ON phase or MMC_POWER_OFF
phase should work, let's do the latter.

This patch is tested on RK3588s/RK3399/RK3576 EVB with TF cards with both
vqmmc present or not.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:52 +01:00
Rob Herring (Arm)
5962f68603 dt-bindings: mmc: arasan,sdhci: Allow "dma-coherent" property
The Arasan SDHCI controller is DMA coherent on the APM merlin SoC, so allow
the dma-coherent property. No reason implementations can't also be coherent
and there's not an SoC specific compatible, so allow it on any platform.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:52 +01:00
Rob Herring (Arm)
acb52756e9 dt-bindings: mmc: brcm,iproc-sdhci: Allow "dma-coherent" and "iommus" properties
The Broadcom iProc SDHCI controller is DMA coherent and/or behind an IOMMU
on some Broadcom SoCs, so allow the dma-coherent and iommus properties.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:52 +01:00
Rob Herring (Arm)
182b650e4e dt-bindings: mmc: cdns,sdhci: Drop required "resets" on AMD Pensando ELBA
The AMD Pensando ELBA DT defines no reset for the SDHCI, so it is obviously
not required.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:52 +01:00
Luke Wang
8ceb70c9f9 mmc: sdhci-esdhc-imx: wait for data transfer completion before reset
On IMX7ULP platforms, certain SD cards (e.g. Kingston Canvas Go! Plus)
cause system hangs and reboots during manual tuning. These cards exhibit
large gaps (~16us) between tuning command response and data transmission.
When cmd CRC errors occur during tuning, the code assumes data errors even
tuning data hasn't been fully received and then reset host data circuit.

Per IMX7ULP reference manual, reset operations (RESET_DATA/ALL) need to
make sure no active data transfers. Previously, resetting while data was
in-flight would clear data circuit, including ADMA/SDMA address, causing
data to be transmitted to incorrect memory address. This patch adds
polling for data transfer completion before executing resets.

Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com>
Reviewed-by: Bough Chen <haibo.chen@nxp.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:52 +01:00
Louis-Alexis Eyraud
846a3a2fdf mmc: mtk-sd: add support for MT8189 SoC
Even though MMC IP in MT8189 SoC is partially compatible with the one
found in MT8196 SoC, its register layout has some slight differences
and additional features such as the system power management release
resource control support.
Thus, add new compatible and platform data to support this SoC.

Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:52 +01:00
Louis-Alexis Eyraud
a834e60c8a mmc: mtk-sd: add support for SPM resource release control
The MT8189 SoC has in the status register an additional bit field to
release all System Power management (SPM) resource requests.
In preparation of MT8189 SoC support, add its use in suspend callback
and a support flag in the platform data.

Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:52 +01:00
Louis-Alexis Eyraud
7514f64780 dt-bindings: mmc: mtk-sd: Add support for MT8189 SoC
Add a new compatible for MMC IP in MT8189 SoC.
Even though this is partially compatible with the one found in MT8196
SoC, the MT8189 SoC register layout has some slight differences and
additional features.

Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:52 +01:00
Avri Altman
263ff314cc mmc: core: Add quirk for incorrect manufacturing date
Some eMMC vendors need to report manufacturing dates beyond 2025 but are
reluctant to update the EXT_CSD revision from 8 to 9. Changing the
Updating the EXT_CSD revision may involve additional testing or
qualification steps with customers. To ease this transition and avoid a
full re-qualification process, a workaround is needed. This
patch introduces a temporary quirk that re-purposes the year codes
corresponding to 2010, 2011, and 2012 to represent the years 2026, 2027,
and 2028, respectively. This solution is only valid for this three-year
period.

After 2028, vendors must update their firmware to set EXT_CSD_REV=9 to
continue reporting the correct manufacturing date in compliance with the
JEDEC standard.

The `MMC_QUIRK_BROKEN_MDT` is introduced and enabled for all Sandisk
devices to handle this behavior.

Signed-off-by: Avri Altman <avri.altman@sandisk.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:52 +01:00
Avri Altman
3e487a634b mmc: core: Adjust MDT beyond 2025
JEDEC JESD84-B51B which was released in September 2025, increases the
manufacturing year limit for eMMC devices. The eMMC manufacturing year
is stored in a 4-bit field in the CID register. Originally, it covered
1997–2012. Later, with EXT_CSD_REV=8, it was extended up to 2025. Now,
with EXT_CSD_REV=9, the range is rolled over by another 16 years, up to
2038.

The mapping is as follows:
cid[8..11] | rev ≤ 4 | 8 ≥ rev > 4 | rev > 8
---------------------------------------------
0          | 1997    | 2013        | 2029
1          | 1998    | 2014        | 2030
2          | 1999    | 2015        | 2031
3          | 2000    | 2016        | 2032
4          | 2001    | 2017        | 2033
5          | 2002    | 2018        | 2034
6          | 2003    | 2019        | 2035
7          | 2004    | 2020        | 2036
8          | 2005    | 2021        | 2037
9          | 2006    | 2022        | 2038
10         | 2007    | 2023        |
11         | 2008    | 2024        |
12         | 2009    | 2025        |
13         | 2010    |             | 2026
14         | 2011    |             | 2027
15         | 2012    |             | 2028

Signed-off-by: Avri Altman <avri.altman@sandisk.com>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:52 +01:00
Md Sadre Alam
3d9ce86b52 mmc: sdhci-msm: Enable ICE for CQE-capable controllers with non-CQE cards
Enable Inline Crypto Engine (ICE) support for CQE-capable sdhci-msm
controllers when used with eMMC cards that do not support CQE.

This addresses the scenario where:
- The host controller supports CQE (and has CQHCI crypto infrastructure)
- The eMMC card does not support CQE
- Standard (non-CMDQ) requests need crypto support

This allows hardware-accelerated encryption and decryption for standard
requests on CQE-capable hardware by utilizing the existing CQHCI crypto
register space even when CQE functionality is not available due to card
limitations.

The implementation:
- Adds ICE register definitions for non-CQE crypto configuration
- Implements per-request crypto setup via sdhci_msm_ice_cfg()
- Hooks into the request path via mmc_host_ops.request for non-CQE requests
- Uses CQHCI register space (NONCQ_CRYPTO_PARM/DUN) for crypto configuration

With this, CQE-capable controllers can benefit from inline encryption
when paired with non-CQE cards, improving performance for encrypted I/O
while maintaining compatibility with existing CQE crypto support.

Signed-off-by: Md Sadre Alam <quic_mdalam@quicinc.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Acked-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:52 +01:00
Shawn Lin
541fe77cc4 mmc: dw_mmc: add dw_mci_prepare_desc() for both of 32bit and 64bit DMA
dw_mci_prepare_desc64() and dw_mci_prepare_desc32() duplicate a lot of
code, add a new dw_mci_prepare_desc() to save the bits.

No functional change intended.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/aUJatHzP5fr1zvRF@stanley.mountain
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:52 +01:00
Shawn Lin
40dfdd8d14 mmc: dw_mmc: Remove unused struct dma_pdata
None of the variant drivers pass in dma_pdata, which means it's
unused and could be removed.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:06:51 +01:00
Kamal Dasu
79ad471530 mmc: sdhci-brcmstb: use correct register offset for V1 pin_sel restore
The restore path for SDIO_CFG_CORE_V1 was incorrectly using
SDIO_CFG_SD_PIN_SEL (offset 0x44) instead of SDIO_CFG_V1_SD_PIN_SEL
(offset 0x54), causing the wrong register to be written on resume.
The save path already uses the correct V1-specific offset. This
affects BCM7445 and BCM72116 platforms which use the V1 config core.

Fixes: b7e614802e ("mmc: sdhci-brcmstb: save and restore registers during PM")
Signed-off-by: Kamal Dasu <kamal.dasu@broadcom.com>
Cc: stable@vger.kernel.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:05:20 +01:00
Shawn Lin
6465a8bbb0 mmc: dw_mmc-rockchip: Fix runtime PM support for internal phase support
RK3576 is the first platform to introduce internal phase support, and
subsequent platforms are expected to adopt a similar design. In this
architecture, runtime suspend powers off the attached power domain, which
resets registers, including vendor-specific ones such as SDMMC_TIMING_CON0,
SDMMC_TIMING_CON1, and SDMMC_MISC_CON. These registers must be saved and
restored, a requirement that falls outside the scope of the dw_mmc core.

Fixes: 59903441f5 ("mmc: dw_mmc-rockchip: Add internal phase support")
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Tested-by: Marco Schirrmeister <mschirrmeister@gmail.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:05:20 +01:00
Felix Gu
af12e64ae0 mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
When calling of_parse_phandle_with_args(), the caller is responsible
to call of_node_put() to release the reference of device node.
In of_get_dml_pipe_index(), it does not release the reference.

Fixes: 9cb15142d0 ("mmc: mmci: Add qcom dml support to the driver.")
Signed-off-by: Felix Gu <gu_0233@qq.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 12:05:20 +01:00
Irving-CH Lin
82d58440cd dt-bindings: power: Add MediaTek MT8189 power domain
Add dt schema and IDs for the power domain of MediaTek MT8189 SoC.
The MT8189 power domain IP provide power domains control function
for subsys (eg. MFG, audio, venc/vdec ...).

Signed-off-by: Irving-CH Lin <irving-ch.lin@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 11:55:42 +01:00
AngeloGioacchino Del Regno
3cdac25e80 dt-bindings: power: mt7622-power: Add MT7622_POWER_DOMAIN_AUDIO
Add the missing power domain for the Audio IPs in this SoC.

Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 11:55:42 +01:00
Nicolas Frattaroli
425fec07d4 dt-bindings: power: mt8196-gpufreq: Describe nvmem provider ability
On the MediaTek MT8196 SoC, the Mali GPU's "shader_present" hardware
register may also include a non-functional shader core, along with the
present shader cores. An efuse elsewhere in the SoC provides the
shader_present mask with the fused off core omitted.

However, the efuse address is not publicly disclosed. What is known
though is that the GPUEB MCU reads this efuse, and exposes its contents
in the memory it shares with the application processor.

We can therefore describe the mediatek,mt8196-gpufreq device as being an
nvmem provider for this purpose, as it does provide nvmem access in an
indirect way.

The shader-present child node is left out of the list of required
properties as we may one day be able to describe the actual efuse region
this value comes from, so the gpufreq device isn't necessarily the only
device that can provide this cell, and implementations shouldn't need to
implement this functionality once this is the case.

Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 11:55:42 +01:00
Karel Balej
d28cb72e07 dt-bindings: power: define ID for Marvell PXA1908 audio domain
Define an identifier for the SoC's audio power island so that it can be
referenced through device tree.

Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Duje Mihanović <duje@dujemihanovic.xyz>
Signed-off-by: Karel Balej <balejk@matfyz.cz>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-23 11:55:42 +01:00
Bartosz Golaszewski
ec2cceadfa gpiolib: normalize the return value of gc->get() on behalf of buggy drivers
Commit 86ef402d80 ("gpiolib: sanitize the return value of
gpio_chip::get()") started checking the return value of the .get()
callback in struct gpio_chip. Now - almost a year later - it turns out
that there are quite a few drivers in tree that can break with this
change. Partially revert it: normalize the return value in GPIO core but
also emit a warning.

Cc: stable@vger.kernel.org
Fixes: 86ef402d80 ("gpiolib: sanitize the return value of gpio_chip::get()")
Reported-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Closes: https://lore.kernel.org/all/aZSkqGTqMp_57qC7@google.com/
Reviewed-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Link: https://patch.msgid.link/20260219-gpiolib-set-normalize-v2-1-f84630e45796@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-02-23 11:49:23 +01:00
Maxime Ripard
8b85987d3c
Merge drm/drm-next into drm-misc-next
Let's merge 7.0-rc1 to start the new drm-misc-next window

Signed-off-by: Maxime Ripard <mripard@kernel.org>
2026-02-23 11:48:20 +01:00
Jouni Högander
eb4a7139e9 drm/i915/alpm: ALPM disable fixes
PORT_ALPM_CTL is supposed to be written only before link training. Remove
writing it from ALPM disable.

Also clearing ALPM_CTL_ALPM_AUX_LESS_ENABLE and is not about disabling ALPM
but switching to AUX-Wake ALPM. Stop touching this bit on ALPM disable.

Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7153
Fixes: 1ccbf13586 ("drm/i915/psr: Enable ALPM on source side for eDP Panel replay")
Cc: Animesh Manna <animesh.manna@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: <stable@vger.kernel.org> # v6.10+
Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
Link: https://patch.msgid.link/20260212062731.397801-1-jouni.hogander@intel.com
(cherry picked from commit 008304c9ae)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-02-23 12:44:06 +02:00
Haocheng Yu
77de62ad3d perf/core: Fix refcount bug and potential UAF in perf_mmap
Syzkaller reported a refcount_t: addition on 0; use-after-free warning
in perf_mmap.

The issue is caused by a race condition between a failing mmap() setup
and a concurrent mmap() on a dependent event (e.g., using output
redirection).

In perf_mmap(), the ring_buffer (rb) is allocated and assigned to
event->rb with the mmap_mutex held. The mutex is then released to
perform map_range().

If map_range() fails, perf_mmap_close() is called to clean up.
However, since the mutex was dropped, another thread attaching to
this event (via inherited events or output redirection) can acquire
the mutex, observe the valid event->rb pointer, and attempt to
increment its reference count. If the cleanup path has already
dropped the reference count to zero, this results in a
use-after-free or refcount saturation warning.

Fix this by extending the scope of mmap_mutex to cover the
map_range() call. This ensures that the ring buffer initialization
and mapping (or cleanup on failure) happens atomically effectively,
preventing other threads from accessing a half-initialized or
dying ring buffer.

Closes: https://lore.kernel.org/oe-kbuild-all/202602020208.m7KIjdzW-lkp@intel.com/
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Haocheng Yu <yuhaocheng035@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260202162057.7237-1-yuhaocheng035@gmail.com
2026-02-23 11:19:25 +01:00
Zide Chen
6a8a48644c perf/x86/intel/uncore: Add per-scheduler IMC CAS count events
IMC on SPR and EMR does not support sub-channels.  In contrast, CPUs
that use gnr_uncores[] (e.g. Granite Rapids and Sierra Forest)
implement two command schedulers (SCH0/SCH1) per memory channel,
providing logically independent command and data paths.

Do not reuse the spr_uncore_imc[] configuration for these CPUs.
Instead, introduce a dedicated gnr_uncore_imc[] with per-scheduler
events, so userspace can monitor SCH0 and SCH1 independently.

On these CPUs, replace cas_count_{read,write} with
cas_count_{read,write}_sch{0,1}.  This may break existing userspace
that relies on cas_count_{read,write}, prompting it to switch to the
per-scheduler events, as the legacy event reports only partial
traffic (SCH0).

Fixes: 632c4bf6d0 ("perf/x86/intel/uncore: Support Granite Rapids")
Fixes: cb4a6ccf35 ("perf/x86/intel/uncore: Support Sierra Forest and Grand Ridge")
Reported-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260210005225.20311-1-zide.chen@intel.com
2026-02-23 11:19:25 +01:00
Namhyung Kim
486ff5ad49 perf/core: Fix invalid wait context in ctx_sched_in()
Lockdep found a bug in the event scheduling when a pinned event was
failed and wakes up the threads in the ring buffer like below.

It seems it should not grab a wait-queue lock under perf-context lock.
Let's do it with irq_work.

  [   39.913691] =============================
  [   39.914157] [ BUG: Invalid wait context ]
  [   39.914623] 6.15.0-next-20250530-next-2025053 #1 Not tainted
  [   39.915271] -----------------------------
  [   39.915731] repro/837 is trying to lock:
  [   39.916191] ffff88801acfabd8 (&event->waitq){....}-{3:3}, at: __wake_up+0x26/0x60
  [   39.917182] other info that might help us debug this:
  [   39.917761] context-{5:5}
  [   39.918079] 4 locks held by repro/837:
  [   39.918530]  #0: ffffffff8725cd00 (rcu_read_lock){....}-{1:3}, at: __perf_event_task_sched_in+0xd1/0xbc0
  [   39.919612]  #1: ffff88806ca3c6f8 (&cpuctx_lock){....}-{2:2}, at: __perf_event_task_sched_in+0x1a7/0xbc0
  [   39.920748]  #2: ffff88800d91fc18 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_in+0x1f9/0xbc0
  [   39.921819]  #3: ffffffff8725cd00 (rcu_read_lock){....}-{1:3}, at: perf_event_wakeup+0x6c/0x470

Fixes: f4b07fd62d ("perf/core: Use POLLHUP for a pinned event in error")
Closes: https://lore.kernel.org/lkml/aD2w50VDvGIH95Pf@ly-workstation
Reported-by: "Lai, Yi" <yi1.lai@linux.intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: "Lai, Yi" <yi1.lai@linux.intel.com>
Link: https://patch.msgid.link/20250603045105.1731451-1-namhyung@kernel.org
2026-02-23 11:19:25 +01:00
Mathieu Desnoyers
3b68df9781 rseq: slice ext: Ensure rseq feature size differs from original rseq size
Before rseq became extensible, its original size was 32 bytes even
though the active rseq area was only 20 bytes. This had the following
impact in terms of userspace ecosystem evolution:

* The GNU libc between 2.35 and 2.39 expose a __rseq_size symbol set
  to 32, even though the size of the active rseq area is really 20.
* The GNU libc 2.40 changes this __rseq_size to 20, thus making it
  express the active rseq area.
* Starting from glibc 2.41, __rseq_size corresponds to the
  AT_RSEQ_FEATURE_SIZE from getauxval(3).

This means that users of __rseq_size can always expect it to
correspond to the active rseq area, except for the value 32, for
which the active rseq area is 20 bytes.

Exposing a 32 bytes feature size would make life needlessly painful
for userspace. Therefore, add a reserved field at the end of the
rseq area to bump the feature size to 33 bytes. This reserved field
is expected to be replaced with whatever field will come next,
expecting that this field will be larger than 1 byte.

The effect of this change is to increase the size from 32 to 64 bytes
before we actually have fields using that memory.

Clarify the allocation size and alignment requirements in the struct
rseq uapi comment.

Change the value returned by getauxval(AT_RSEQ_ALIGN) to return the
value of the active rseq area size rounded up to next power of 2, which
guarantees that the rseq structure will always be aligned on the nearest
power of two large enough to contain it, even as it grows. Change the
alignment check in the rseq registration accordingly.

This will minimize the amount of ABI corner-cases we need to document
and require userspace to play games with. The rule stays simple when
__rseq_size != 32:

  #define rseq_field_available(field)	(__rseq_size >= offsetofend(struct rseq_abi, field))

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260220200642.1317826-3-mathieu.desnoyers@efficios.com
2026-02-23 11:19:19 +01:00
Mathieu Desnoyers
26d43a90be rseq: Clarify rseq registration rseq_size bound check comment
The rseq registration validates that the rseq_size argument is greater
or equal to 32 (the original rseq size), but the comment associated with
this check does not clearly state this.

Clarify the comment to that effect.

Fixes: ee3e3ac05c ("rseq: Introduce extensible rseq ABI")
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260220200642.1317826-2-mathieu.desnoyers@efficios.com
2026-02-23 11:19:19 +01:00
Peter Zijlstra
5324953c06 sched/core: Fix wakeup_preempt's next_class tracking
Kernel test robot reported that
tools/testing/selftests/kvm/hardware_disable_test was failing due to
commit 704069649b ("sched/core: Rework sched_class::wakeup_preempt()
and rq_modified_*()")

It turns out there were two related problems that could lead to a
missed preemption:

 - when hitting newidle balance from the idle thread, it would elevate
   rb->next_class from &idle_sched_class to &fair_sched_class, causing
   later wakeup_preempt() calls to not hit the sched_class_above()
   case, and not issue resched_curr().

   Notably, this modification pattern should only lower the
   next_class, and never raise it. Create two new helper functions to
   wrap this.

 - when doing schedule_idle(), it was possible to miss (re)setting
   rq->next_class to &idle_sched_class, leading to the very same
   problem.

Cc: Sean Christopherson <seanjc@google.com>
Fixes: 704069649b ("sched/core: Rework sched_class::wakeup_preempt() and rq_modified_*()")
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202602122157.4e861298-lkp@intel.com
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260218163329.GQ1395416@noisy.programming.kicks-ass.net
2026-02-23 11:19:19 +01:00
Arnd Bergmann
4c652a4772 rseq: Mark rseq_arm_slice_extension_timer() __always_inline
objtool warns about this function being called inside of a uaccess
section:

kernel/entry/common.o: warning: objtool: irqentry_exit+0x1dc: call to rseq_arm_slice_extension_timer() with UACCESS enabled

Interestingly, this happens with CONFIG_RSEQ_SLICE_EXTENSION disabled,
so this is an empty function, as the normal implementation is
already marked __always_inline.

I could reproduce this multiple times with gcc-11 but not with gcc-15,
so the compiler probably got better at identifying the trivial function.

Mark all the empty helpers for !RSEQ_SLICE_EXTENSION as __always_inline
for consistency, avoiding this warning.

Fixes: 0ac3b5c3dc ("rseq: Implement time slice extension enforcement timer")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260206074122.709580-1-arnd@kernel.org
2026-02-23 11:19:19 +01:00