Commit graph

1,461,765 commits

Author SHA1 Message Date
Ben Levinsky
f87b499899 remoteproc: Add AMD MicroBlaze/V BRAM-based remote processor driver
Add a remoteproc driver for AMD MicroBlaze/V soft-core processor
subsystems instantiated in programmable logic and using dual-port BRAM
for firmware storage and execution.

The driver parses the firmware memory window from the remoteproc device
node's reg property, interprets that address and size in the
processor-local address space, and then uses standard devicetree address
translation through the parent bus ranges property to obtain the
corresponding Linux-visible system physical address.

The resulting translated region is registered as the executable
remoteproc carveout and coredump segment.

The processor is controlled through an active-low reset GPIO and a
subsystem clock. The clock is enabled before reset is released, and the
processor is kept in reset until firmware loading completes.

The firmware-name property is optional, allowing firmware to be assigned
later through the remoteproc framework. Firmware images without a
resource table are also accepted.

Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>
Link: https://lore.kernel.org/r/20260714202441.554065-3-ben.levinsky@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-07-20 11:15:43 -06:00
Ben Levinsky
8527ebd21a dt-bindings: remoteproc: Document AMD MicroBlaze/V BRAM-based rproc
Describe an AMD MicroBlaze/V BRAM-based remote processor controlled
through the remoteproc framework.

The binding models a soft-core processor subsystem instantiated in AMD
programmable logic and using dual-port BRAM for firmware storage and
execution. The remoteproc device is represented as a child node whose
reg property describes the firmware memory window in the processor-local
address space. The parent bus node provides standard devicetree address
translation through ranges so Linux can access the same BRAM through the
system physical address space.

A clock input feeds the soft-core processor subsystem, and an active-low
reset GPIO holds the processor in reset until firmware loading completes.
The firmware-name property is optional.

Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>
Link: https://lore.kernel.org/r/20260714202441.554065-2-ben.levinsky@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-07-20 11:12:47 -06:00
Ananthu C V
40acbf6097 dt-bindings: remoteproc: qcom: move glymur SoCCP pas to standalone
SHM bridge creation is required to enable memory protection for both
remoteproc metadata and its memory region on Qualcomm SoCs like Glymur
running non-Gunyah based Hypervisors, unlike Kaanapali.

Having Glymur fall back to the Kaanapali binding is therefore incorrect
and breaks subsystem restart on Glymur.

Fix this by decoupling Glymur SoCCP PAS from Kaanapali and registering
it as its own binding.

Fixes: 8b54bacadc ("dt-bindings: remoteproc: qcom: Document pas for SoCCP on Kaanapali and Glymur platforms")
Signed-off-by: Ananthu C V <ananthu.cv@oss.qualcomm.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260709-glymur-soccp-v6-1-16f70227547d@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-18 17:05:14 -05:00
Krzysztof Kozlowski
a83689d50e dt-bindings: remoteproc: Drop redundant $ref of firmware-name property
The DT schema core defines the type ($ref) of 'firmware-name' property
as string-array, so individual schemas do not need to.  They also should
not redefine it to a single string, but instead just set number of
expected firmware names.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260712145718.126492-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15 12:19:08 -05:00
Vishnu Santhosh
e1de7da254 remoteproc: qcom_q6v5_pas: Create platform device for BAM-DMUX
Some Qualcomm SoCs using the generic PAS remoteproc driver (e.g.
Shikra) implement the BAM-DMUX protocol on the modem remoteproc to
expose network data channels. The hardware/firmware resources
required by the BAM-DMUX driver are described in an extra device
tree node below the modem remoteproc, with the compatible
"qcom,bam-dmux".

qcom_q6v5_mss.c already creates a platform device for this node
(commit 59983c74fc ("remoteproc: qcom_q6v5_mss: Create platform
device for BAM-DMUX")), but qcom_q6v5_pas.c has no equivalent logic,
so the bam-dmux node never probes on SoCs handled by this driver.

Mirror the qcom_q6v5_mss.c approach: create a platform device
specifically for the "qcom,bam-dmux" child node on probe, and
destroy it on remove. of_get_compatible_child() returns NULL when
the node is absent, and of_platform_device_create()/of_node_put()
are NULL-safe, so this is a no-op for the many PAS-based SoCs that
have no bam-dmux child.

Signed-off-by: Vishnu Santhosh <vishnu.santhosh@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260711-qcom-q6v5-pas-bam-dmux-v1-1-1e9231143b79@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15 12:18:05 -05:00
Jingyi Wang
0ec167625b remoteproc: core: cancel crash_handler work in rproc_add() error path
Ensure crash_handler work is cancelled before tearing down rproc resources
to avoid accessing freed memory.

Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623-rproc-attach-issue-v3-3-8e24310707ce@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15 12:18:05 -05:00
Jingyi Wang
f44ae8ce15 remoteproc: qcom: Check subdev start status in rproc_stop()
For rproc that doing attach, rproc_start_subdevices() is called only when
attach successfully. If rproc_report_crash() is called in the attach
function, rproc_boot_recovery()->rproc_stop()->rproc_stop_subdevices()->
glink_subdev_stop() could be called and cause NULL pointer dereference:

 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000300
 Mem abort info:
 ...
 pc : qcom_glink_smem_unregister+0x14/0x48 [qcom_glink_smem]
 lr : glink_subdev_stop+0x1c/0x30 [qcom_common]
 ...
 Call trace:
  qcom_glink_smem_unregister+0x14/0x48 [qcom_glink_smem] (P)
  glink_subdev_stop+0x1c/0x30 [qcom_common]
  rproc_stop+0x58/0x17c
  rproc_trigger_recovery+0xb0/0x150
  rproc_crash_handler_work+0xa4/0xc4
  process_scheduled_works+0x18c/0x2d8
  worker_thread+0x144/0x280
  kthread+0x124/0x138
  ret_from_fork+0x10/0x20
 Code: a9be7bfd 910003fd a90153f3 aa0003f3 (b9430000)
 ---[ end trace 0000000000000000 ]---

Introduce "subdevs_started" flag to indicate rproc_start_subdevices() has
been called successfully. Ensure subdevices are only stopped if they have
been started.

Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623-rproc-attach-issue-v3-2-8e24310707ce@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15 12:18:05 -05:00
Jingyi Wang
026a3fada4 remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()
Unlike the remoteproc firmware load path where rproc_add() call
rproc_auto_boot_callback() asynchronously and ignores the return value of
rproc_boot(), the attach path calls rproc_boot() synchronously and
propagates its return value back to rproc_add(). This means a failure
during rproc_attach() causes rproc_add() to fail and triggers resource
release, removing the remoteproc from sysfs and making it unavailable for
recovery or further boot attempts.

Align the remoteproc attach path with the firmware load path by
introducing attach_work and scheduling rproc_boot() asynchronously via
schedule_work(). This keeps the remoteproc registered and available in
sysfs even if the initial attach attempt fails, and avoids blocking
rproc_add() on the attach result.

Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623-rproc-attach-issue-v3-1-8e24310707ce@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15 12:18:05 -05:00
Yijie Yang
3d88927742 dt-bindings: remoteproc: qcom,sm8550-pas: Add Qualcomm Maili ADSP and CDSP
Document compatible strings for the ADSP and CDSP Peripheral Authentication
Services on the Qualcomm Maili SoC. Both are compatible with the Qualcomm
SM8550 PAS and can fallback to SM8550 except for one additional interrupt
("shutdown-ack"). For CDSP, similar to Kaanapali, "global_sync_mem" is
not managed by the kernel.

Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Yijie Yang <yijie.yang@oss.qualcomm.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Acked-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260615-remoteproc-v1-1-67721b4b052a@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15 12:18:05 -05:00
Abel Vesa
bb7c5d6f5b remoteproc: qcom: q6v5: Make handover IRQ one-shot
The handover interrupt is expected to be consumed once during each prepare
cycle. If the remote processor keeps signalling handover after the first
event, qcom_q6v5 currently logs the duplicate interrupt repeatedly while
leaving the IRQ enabled.

Track the handover IRQ enable state explicitly and route all handover IRQ
enable/disable operations through idempotent helpers. Request the handover
IRQ with IRQF_NO_AUTOEN so it is only enabled through the helper during
prepare. The handover handler disables it after marking handover as issued,
while unprepare disables and synchronizes it before checking whether
handover was issued.

Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260612-rproc-q6v5-handover-irq-one-shot-v1-1-bb688f4446b3@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15 12:18:05 -05:00
Uday Khare
44f4911ab8 remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev
In qcom_add_glink_subdev(), the device node reference acquired via
of_get_child_by_name() is stored in glink->node. If the subsequent
kstrdup_const() allocation for glink->ssr_name fails, the function
returns early without calling of_node_put() on glink->node, leaking
the reference count.

Fix this by adding of_node_put(glink->node) on the error path before
returning.

Fixes: cd9fc8f1b3 ("remoteproc: qcom: Pass ssr_name to glink subdevice")
Signed-off-by: Uday Khare <udaykhare77@gmail.com>
Link: https://lore.kernel.org/r/20260618132054.11010-1-udaykhare77@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15 12:18:05 -05:00
Stephan Gerhold
846baa5ab4 remoteproc: qcom_q6v5_mss: Fix MDM9607 subsystem control instance ID
On MDM9607, the modem firmware exposes the QMI subsystem control service
with instance ID 0x22 (34), as visible e.g. with qrtr-lookup:

  $ qrtr-lookup
  Service Version Instance Node  Port
       43       2       34    3     1 Subsystem control service

Currently, qcom_q6v5_mss uses ssctl_id 0x12 for all platforms. The QMI
service never shows up with this ID, leading to the following error when
trying to shutdown the modem:

  qcom-q6v5-mss 4080000.remoteproc: timeout waiting for ssctl service

Set the correct ssctl_id to allow clean shutdown of the modem firmware with
the subsystem control service. ssctl_id 0x22 is also used by other
modem-only Qualcomm platforms in qcom_q6v5_pas, such as SDX55.

Fixes: 4fe236a1d0 ("remoteproc: qcom_q6v5_mss: Add MDM9607")
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260706-qcom-q6v5-mss-mdm9607-ssctl-id-v1-2-f59e728af621@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15 12:18:04 -05:00
Stephan Gerhold
6aa64a4c89 remoteproc: qcom_q6v5_mss: Make ssctl_id configurable per platform
Currently, qcom_q6v5_mss hardcodes 0x12 as the instance ID for the
subsystem control (ssctl) QMI service. However, some platforms (e.g.
MDM9607) provide the service with a different instance ID (0x22).

Make it possible to override the ssctl_id per platform by adding it to the
platform-specific rproc_hexagon_res struct. The same pattern also exists
already inside qcom_q6v5_pas.

Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260706-qcom-q6v5-mss-mdm9607-ssctl-id-v1-1-f59e728af621@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15 12:18:04 -05:00
Ananthu C V
c220006376 remoteproc: qcom: pas: add needs_tzmem flag to trigger shmbridge creation
SHM bridge creation is required to enable memory protection for both
remoteproc metadata and its memory region on Qualcomm SoCs running
non-Gunyah based Hypervisors. We currently rely on the iommu property
being present in the remoteproc nodes to detect this.

However, this doesn't cover for cases where the remoteproc does a late
attach, like SoCCP, and for remoteprocs like OOBM SS (Out of Band
Management Sub-system) that doesn't have an iommu in front of it. In the
former case, any attempt to create new mappings would fail with EEXIST
as they are already setup by the bootloader when the SoCCP is brought
out of reset, and unmapping them to create fresh mappings leads to faults
since SoCCP could have active transactions on the bus. In the latter case,
absence of iommu will be caught by the has_iommu flag, and SHM bridge
creation will be skipped.

Fix this by introducing a needs_tzmem flag which would cover for the
above edge cases by serving as an alternate trigger to the PAS helpers
to ensure that SHM bridge is established.

Signed-off-by: Ananthu C V <ananthu.cv@oss.qualcomm.com>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260707-glymur-soccp-v5-1-053993f0c6fe@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-15 12:18:04 -05:00
Val Packett
3dbc90b9c2 remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
The changes introduced to handle single power domain platforms have
swapped the info pointer increment from num_pd_vregs to num_pds, which
would shift the info pointer past the end of the array for pronto-v3,
which does not list power domain regulators in vregs.

This showed up as a difference between GCC- and LLVM-compiled kernels
on SDM632 devices, where only with LLVM one would get the
"regulator request with no identifier" error, because the out-of-bounds
memory ended up being zeroed. Fix by skipping the increment when there
are more power domains than regulators.

Signed-off-by: Val Packett <val@packett.cool>
Fixes: 65991ea8a6 ("remoteproc: qcom_wcnss: Handle platforms with only single power domain")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Fixes: 65991ea8a6 ("remoteproc: qcom_wcnss: Handle platforms with only  single power domain")
Link: https://lore.kernel.org/r/20260201210230.911220-1-val@packett.cool
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-09 15:03:00 -05:00
Felix Gu
8c952807c2 remoteproc: qcom_q6v5_adsp: Fix reference leak for device node
When calling of_parse_phandle_with_args(), the caller is responsible
to call of_node_put() to release the reference of device node.
In adsp_map_carveout, it does not release the reference.

Fixes: f22eedff28 ("remoteproc: qcom: Add support for memory sandbox")
Signed-off-by: Felix Gu <gu_0233@qq.com>
Link: https://lore.kernel.org/r/tencent_EDC2253D3B1C22217E1259E07765D269100A@qq.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-09 14:44:19 -05:00
Sumit Garg
c4383254ac remoteproc: qcom: Select QCOM_PAS generic service
Select PAS generic service driver to enable support for multiple PAS
backends like OP-TEE in addition to SCM.

Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Lemans
Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com> # IPQ9650
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260702115835.167602-8-sumit.garg@kernel.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-09 14:21:57 -05:00
Sumit Garg
ea3b5245f5 remoteproc: qcom_wcnss: Switch to generic PAS TZ APIs
Switch qcom_wcnss client driver over to generic PAS TZ APIs. Generic PAS
TZ service allows to support multiple TZ implementation backends like QTEE
based SCM PAS service, OP-TEE based PAS service and any further future TZ
backend service.

Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Lemans
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260702115835.167602-7-sumit.garg@kernel.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-09 14:21:57 -05:00
Sumit Garg
f3b1357673 remoteproc: qcom_q6v5_mss: Switch to generic PAS TZ APIs
Switch qcom_q6v5_mss client driver over to generic PAS TZ APIs. Generic PAS
TZ service allows to support multiple TZ implementation backends like QTEE
based SCM PAS service, OP-TEE based PAS service and any further future TZ
backend service.

Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Lemans
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260702115835.167602-6-sumit.garg@kernel.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-09 14:21:57 -05:00
Sumit Garg
254030af0d remoteproc: qcom_q6v5_pas: Switch over to generic PAS TZ APIs
Switch qcom_q6v5_pas client driver over to generic PAS TZ APIs. Generic PAS
TZ service allows to support multiple TZ implementation backends like QTEE
based SCM PAS service, OP-TEE based PAS service and any further future TZ
backend service.

Since qcom_q6v5_pas depends on MDT loader for PAS firmware loading, it
has to be switched over to generic PAS APIs in this commit to avoid any
build issues.

Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Lemans
Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com> # IPQ9650
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260702115835.167602-5-sumit.garg@kernel.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-09 14:21:57 -05:00
Bjorn Andersson
6e9448b3dc Merge branch '20260702115835.167602-2-sumit.garg@kernel.org' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into rproc-next
Merge Qualcomm generic pas service from SoC topic branch to faciliate
dependencies for the upcoming remoteproc driver changes.
2026-07-09 14:21:11 -05:00
Sumit Garg
6701259025 MAINTAINERS: Add maintainer entry for Qualcomm PAS TZ service
Add Sumit Garg as the maintainer for the Qualcomm generic Peripheral
Authentication Service (PAS) as well as the PAS TEE backend driver.

Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260702115835.167602-15-sumit.garg@kernel.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-09 14:12:58 -05:00
Sumit Garg
b6f7978da0 firmware: qcom: Add a PAS TEE service
Add support for Peripheral Authentication Service (PAS) driver based
on TEE bus with OP-TEE providing the backend PAS service implementation.

The TEE PAS service ABI is designed to be extensible with additional API
as PTA_QCOM_PAS_CAPABILITIES. This allows to accommodate any future
extensions of the PAS service needed while still maintaining backwards
compatibility.

Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Lemans
Reviewed-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com> # IPQ9650
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260702115835.167602-4-sumit.garg@kernel.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-09 14:12:58 -05:00
Sumit Garg
5c1a2975d2 firmware: qcom_scm: Migrate to generic PAS service
With the availability of generic PAS service, let's add SCM calls as
a backend to keep supporting legacy QTEE interfaces. The exported
qcom_scm* wrappers will get dropped once all the client drivers get
migrated as part of future patches.

Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Lemans
Reviewed-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com> # IPQ9650
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260702115835.167602-3-sumit.garg@kernel.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-09 14:12:58 -05:00
Sumit Garg
08314e7c2c firmware: qcom: Add a generic PAS service
Qcom platforms has the legacy of using non-standard SCM calls
splintered over the various kernel drivers. These SCM calls aren't
compliant with the standard SMC calling conventions which is a
prerequisite to enable migration to the FF-A specifications from Arm.

OP-TEE as an alternative trusted OS to Qualcomm TEE (QTEE) can't
support these non-standard SCM calls. And even for newer architectures
using S-EL2 with Hafnium support, QTEE won't be able to support SCM
calls either with FF-A requirements coming in. And with both OP-TEE
and QTEE drivers well integrated in the TEE subsystem, it makes further
sense to reuse the TEE bus client drivers infrastructure.

The added benefit of TEE bus infrastructure is that there is support
for discoverable/enumerable services. With that client drivers don't
have to manually invoke a special SCM call to know the service status.

So enable the generic Peripheral Authentication Service (PAS) provided
by the firmware. It acts as the common layer with different TZ
backends plugged in whether it's an SCM implementation or a proper
TEE bus based PAS service implementation.

Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Lemans
Reviewed-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com> # IPQ9650
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260702115835.167602-2-sumit.garg@kernel.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-09 14:12:58 -05:00
Johan Hovold
22f9efb3ae remoteproc: scp: Fix device reference leak on failed lookup
Make sure to drop the reference taken to the SCP device when attempting
to look up its driver data before the driver has been bound.

Note that holding a reference to a device does not prevent its driver
data from going away.

Fixes: 63c13d61ea ("remoteproc/mediatek: add SCP support for mt8183")
Cc: stable@vger.kernel.org	# 5.6
Cc: Erin Lo <erin.lo@mediatek.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20260706065614.389412-1-johan@kernel.org
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-07-08 10:59:35 -06:00
Krzysztof Kozlowski
f4bb5a75bb remoteproc: ti_k3_r5: Drop redundant NULL check on reset control get
devm_reset_control_get_exclusive() does not return NULL (only valid
clock or ERR pointer in case for non-optional get), so simplify the code
to drop redundant IS_ERR_OR_NULL().

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Link: https://lore.kernel.org/r/20260705172353.119031-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-07-08 10:50:46 -06:00
Tanmay Shah
5ae3dc0788 remoteproc: xlnx: Add crash detection mechanism
Remote processor will report the crash reason via the resource table
and notify the host via mailbox notification. The host checks this
crash reason on every mailbox notification from the remote and report
to the rproc core framework. Then the rproc core framework will start
the recovery process.

Signed-off-by: Tanmay Shah <tanmay.shah@amd.com>
Link: https://lore.kernel.org/r/20260630004806.3835488-3-tanmay.shah@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-07-06 11:38:48 -06:00
Tanmay Shah
d93ffd549f remoteproc: core: Full attach detach during recovery
Current attach on recovery mechanism loads the clean resource table
during recovery, but doesn't re-allocate the resources. RPMsg
communication will fail after recovery due to this. Fix this
incorrect behavior by doing the full detach and attach of remote
processor during the recovery. This will load the clean resource table
and re-allocate all the resources, which will set up correct vring
information in the resource table.

Signed-off-by: Tanmay Shah <tanmay.shah@amd.com>
Link: https://lore.kernel.org/r/20260630004806.3835488-2-tanmay.shah@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-07-06 11:21:36 -06:00
Jingyi Wang
1f9ecae2ec remoteproc: qcom_q6v5_pas: Add SoCCP node on Kaanapali
The SoC Control Processor (SoCCP) is small RISC-V MCU that controls
USB Type-C, battery charging and various other functions on Qualcomm SoCs.
It provides a solution for control-plane processing, reducing per-subsystem
microcontroller reinvention. Add support for SoCCP PAS loader on Kaanapali
platform.

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Hawi SoC
Link: https://lore.kernel.org/r/20260623-knp-soccp-v7-6-1ec7bb5c9fec@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-01 15:24:49 -05:00
Jingyi Wang
16472c99f4 remoteproc: qcom: pas: Add late attach support for subsystems
Subsystems can be brought out of reset by entities such as bootloaders.
As the irq enablement could be later than subsystem bring up, the state
of subsystem should be checked by reading SMP2P bits.

A new qcom_pas_attach() function is introduced. if crash state is detected
for the subsystem, rproc_report_crash() is called. If the ready state is
detected meanwhile stop state is not detected, it will be marked as
"attached", otherwise it could be the early boot feature is not supported
by other entities or it has already been stopped. In above cases, the
state will be marked as RPROC_OFFLINE so that the PAS driver can load the
firmware and start the remoteproc.

Co-developed-by: Gokul Krishna Krishnakumar <gokul.krishnakumar@oss.qualcomm.com>
Signed-off-by: Gokul Krishna Krishnakumar <gokul.krishnakumar@oss.qualcomm.com>
Tested-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623-knp-soccp-v7-5-1ec7bb5c9fec@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-01 15:24:49 -05:00
Mukesh Ojha
f45ec01bae dt-bindings: remoteproc: qcom: Document pas for SoCCP on Hawi and Maili SoC
Document SoCCP remote processor used on Qualcomm Hawi and Maili SoC which
is fully compatible with Kaanapali.

Co-developed-by: Yijie Yang <yijie.yang@oss.qualcomm.com>
Signed-off-by: Yijie Yang <yijie.yang@oss.qualcomm.com>
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623-knp-soccp-v7-4-1ec7bb5c9fec@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-01 15:24:49 -05:00
Jingyi Wang
8b54bacadc dt-bindings: remoteproc: qcom: Document pas for SoCCP on Kaanapali and Glymur platforms
Document the component used to boot SoCCP on Kaanapali SoC and add
compatible for Glymur SoCCP which could fallback to Kaanapali. Extend
the "qcom,smem-states", "qcom,smem-state-names" in the pas-common
and add maxItems constraints for SMEM properties in the documents
that reference to pas-common.

Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623-knp-soccp-v7-3-1ec7bb5c9fec@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-01 15:24:49 -05:00
Jingyi Wang
5eb8427596 dt-bindings: remoteproc: qcom: move interrupts and interrupt-names list out of pas-common
Move interrupts and interrupt-names list out of pas-common since they
will be redefined differently for Kaanapali SoCCP.

Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623-knp-soccp-v7-2-1ec7bb5c9fec@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-01 15:24:48 -05:00
Jingyi Wang
9698acea9b dt-bindings: remoteproc: qcom: cleanup qcom,adsp.yaml
Items in qcom,adsp.yaml has common clock and interrupt properties, move
these out of the allOf section to avoid list the compatible repeatly.

Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623-knp-soccp-v7-1-1ec7bb5c9fec@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-01 15:24:48 -05:00
Ben Levinsky
5254315483 remoteproc: guard wc-ioremap helpers with HAS_IOMEM
The common wc-ioremap carveout callbacks live in
remoteproc_internal.h, which is included by the remoteproc core.
This means the helper bodies are parsed even for builds that do not
enable any platform driver using those callbacks.

On s390, CONFIG_HAS_IOMEM and CONFIG_GENERIC_IOREMAP depend on
CONFIG_PCI. A randconfig with CONFIG_REMOTEPROC=y and CONFIG_PCI=n
therefore has no usable ioremap_wc() or iounmap() declarations, and
fails to build the common remoteproc objects with implicit declarations
from the helper bodies.

Only include linux/io.h and build the real wc-ioremap helpers when
CONFIG_HAS_IOMEM is enabled. Provide no-IOMEM stubs so the internal
header remains self-contained for randconfig and COMPILE_TEST coverage.

Fixes: 50227acbf4 ("remoteproc: Add common wc-ioremap carveout callbacks")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202606301559.w8eorNQ2-lkp@intel.com/
Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>

Link: https://lore.kernel.org/r/20260630174056.667646-1-ben.levinsky@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-07-01 08:48:38 -06:00
Tanmay Shah
70cfc11cfc remoteproc: xlnx: Refactor start & stop ops
Current _start and _stop ops are implemented using various APIs from the
platform management firmware driver. Instead provide respective RPU
start and stop API in the firmware driver and move the logic to interact
with the PM firmware in the firmware driver. The remoteproc driver doesn't
need to know actual logic, but only the final result i.e. RPU start/stop
was success or not. This refactor keeps the remoteproc driver simple and
moves firmware interaction logic to the firmware driver.

Signed-off-by: Tanmay Shah <tanmay.shah@amd.com>
Acked-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/20260619163854.410392-1-tanmay.shah@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-06-29 09:42:22 -06:00
Rob Herring (Arm)
738a5c60c3 remoteproc: Use presence checks for syscon props
The OMAP and Keystone remoteproc drivers only need to know whether
"ti,bootreg" and "ti,syscon-dev" are present before parsing them.
Reading those properties as booleans misrepresents their DT encoding.

Use of_property_present() for the presence tests and keep the existing
phandle parsing for the actual property values.

Assisted-by: Codex:gpt-5-5
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://lore.kernel.org/r/20260612214959.1884404-1-robh@kernel.org
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-06-29 09:39:35 -06:00
Ben Levinsky
65bb7dee37 remoteproc: Switch drivers to optional resource-table helper
Use the shared optional resource-table helper in the remoteproc drivers
that already treat a missing resource table as non-fatal:
xlnx_r5_remoteproc, rcar_rproc, stm32_rproc, imx_rproc, and
imx_dsp_rproc.

Keep thin local parse_fw() wrappers in each driver so the helper only
centralizes the return-value handling while each platform retains
control over whether the missing-table case is logged and at
what severity.

Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>
Tested-by: Peng Fan <peng.fan@nxp.com> #i.MX8MP-EVK
Link: https://lore.kernel.org/r/20260529021637.2077602-6-ben.levinsky@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-06-29 09:34:18 -06:00
Ben Levinsky
e6b4e660f0 remoteproc: Add helper for optional ELF resource tables
Add a helper macro around rproc_elf_load_rsc_table() for thin parse_fw()
wrappers that treat a missing ELF resource table as optional while
keeping per-driver logging decisions local to the caller of
rproc_elf_load_rsc_table_optional().

Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>
Tested-by: Peng Fan <peng.fan@nxp.com> #i.MX8MP-EVK
Link: https://lore.kernel.org/r/20260529021637.2077602-5-ben.levinsky@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-06-29 09:32:43 -06:00
Ben Levinsky
0db071a39c remoteproc: Mark wc-ioremap carveouts as iomem
Carveouts registered through the shared wc-ioremap helper are backed by
I/O memory, but rproc_da_to_va() only reports that to its callers when
mem->is_iomem is set on the carveout.

Without that flag, the remoteproc ELF loader and coredump paths can
fall back to normal memcpy()/memset() accessors instead of the I/O
helpers used for iomapped memory.

Mark shared wc-ioremap carveouts as iomem so the framework uses the
proper memcpy_toio(), memset_io(), and memcpy_fromio() accessors for
these regions.

Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>
Tested-by: Peng Fan <peng.fan@nxp.com> #i.MX8MP-EVK
Link: https://lore.kernel.org/r/20260529021637.2077602-4-ben.levinsky@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-06-29 09:30:58 -06:00
Ben Levinsky
aef86ae680 remoteproc: Switch exact-match drivers to wc-ioremap callbacks
Replace the exact-match carveout map and unmap callbacks in the
existing remoteproc drivers with the common wc-ioremap helpers. This
covers xlnx_r5_remoteproc, rcar_rproc, st_remoteproc, stm32_rproc,
imx_rproc, and imx_dsp_rproc.

Leave the zynqmp R5 TCM callbacks alone because they also clear the
mapped memory and are therefore not exact matches for the shared
helpers.

Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> # renesas
Tested-by: Peng Fan <peng.fan@nxp.com> #i.MX8MP-EVK
Link: https://lore.kernel.org/r/20260529021637.2077602-3-ben.levinsky@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-06-29 09:30:33 -06:00
Ben Levinsky
50227acbf4 remoteproc: Add common wc-ioremap carveout callbacks
Several remoteproc drivers open-code the same ioremap_wc() and
iounmap() callbacks for carveout mappings. Add subsystem-private
helpers in remoteproc_internal.h so those drivers can share the same
implementation.

Keep this change behavior-neutral. The helper now emits a common error
message on ioremap_wc() failure, but leaves mem->is_iomem handling to a
follow-on patch so that the behavioral change can be justified
separately.

Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>
Tested-by: Peng Fan <peng.fan@nxp.com> #i.MX8MP-EVK
Link: https://lore.kernel.org/r/20260529021637.2077602-2-ben.levinsky@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-06-29 09:30:01 -06:00
Linus Torvalds
dc59e4fea9 Linux 7.2-rc1 v7.2-rc1 2026-06-28 12:01:31 -07:00
Linus Torvalds
0716f9b933 NTB updates include an EPF bug fix to prevent an invalid unmap during
device removal, along with documentation fixes and minor AMD driver
 cleanups.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEoE9b9c3U2JxX98mqbmZLrHqL0iMFAmpBIsgACgkQbmZLrHqL
 0iN+tA/+LCXsiysq5XLscCkWL7vwT2rbh/uLBjnBC2YEgfFWOtfOrwnNYlSXEJAo
 PE9RRbqCBGXpv0CQ5iah96ff8HdDU6O36+UD9el1jGxUN/UxtD0Q7ibfsJ+gyf4N
 ANNDrkTAo6AcDxM/AG9B/bBy5EnNDDH1bURIWM3dohp3CNhRbbSHbyiuf20uFgef
 i+iArjk2ePL0tGEzUIEHVsEwGJFVrgAYr/7OZ2dSvpMn8AhI8bj5U3YANwQOnQS6
 QlNKZ/t7mgNJ4zGBIhzQcmUlIuLY0GsOhyKhXAcmc7uNumJotyuTcQ7F3Ybky8DY
 Pjzt7fc+4wT9fH/B303JfuFY2SXUWHkTXA1zZGfeV8zJrljqfEx+8elJAkRR7ifJ
 PVR2w85W88qfW5HfBfiBGstq5aA9aFNQscJQIN//ejjuPbrLPEeIodLte4j8QzRb
 uo+8L1n2TiR7NljdAYBrhuUAnoW5F7sx/k0jsqZvOvM48oVzr1pZeNJF3EG5UHfE
 9RmOx+VuF4f5p0zMYjvhumCRN3p8fwKNDMxGBTGSD4YQ6+SRTh6HnfQDwv4uqVBn
 nC8fBHLEdj4wmUzttYuCOD+ltBN02viyv/bUIQdd+BDjsR5b7q76Rxo3BGkNy1/z
 FdXGFs3L26pOY5X+equ8FAfd5V4sfVL2HZO5PYPclP2HsJroHz8=
 =V3cD
 -----END PGP SIGNATURE-----

Merge tag 'ntb-7.2' of https://github.com/jonmason/ntb

Pull NTB updates from Jon Mason:
 "An EPF bug fix to prevent an invalid unmap during device removal,
  along with documentation fixes and minor AMD driver cleanups"

* tag 'ntb-7.2' of https://github.com/jonmason/ntb:
  ntb: amd: Use named initializer for pci_device_id::driver_data
  NTB: fix kernel-doc warnings in ntb.h
  NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
  ntb_hw_amd: Fix incorrect debug message in link disable path
2026-06-28 07:46:12 -07:00
Linus Torvalds
8b69c04758 Input updates for v7.2-rc0-2
- Updates to Synaptics RMI4 driver to fix potential OOB accesses in
   F30 and F3A keymap handling
 
 - A workaround in Synaptics RMI4 to tolerate buggy firmware on some
   touchpads (e.g. ThinkPad T14 Gen 1) that report incomplete register
   descriptor structures, preventing probe failures
 
 - A revert of an incorrect register descriptor address calculation in
   Synaptics RMI4 driver
 
 - A fix for a regression in HP GSC PS/2 (gscps2) driver where the
   receive buffer write index was not advanced, leaving keyboard and
   mouse unusable.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCakCsxwAKCRBAj56VGEWX
 nCICAQDSgfrAi+4SqTb92EjtdQO+ypluS42mKO75LTitJcS8dAEA1iKmdss8mGww
 c4ai4W+UFxori7IqgkoQ7LfaPTOWlA0=
 =QP4c
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v7.2-rc0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull more input updates from Dmitry Torokhov:

 - Updates to Synaptics RMI4 driver to fix potential OOB accesses in F30
   and F3A keymap handling

 - A workaround in Synaptics RMI4 to tolerate buggy firmware on some
   touchpads (e.g. ThinkPad T14 Gen 1) that report incomplete register
   descriptor structures, preventing probe failures

 - A revert of an incorrect register descriptor address calculation in
   Synaptics RMI4 driver

 - A fix for a regression in HP GSC PS/2 (gscps2) driver where the
   receive buffer write index was not advanced, leaving keyboard and
   mouse unusable.

* tag 'input-for-v7.2-rc0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: gscps2 - advance receive buffer write index
  Input: rmi4 - tolerate short register descriptor structure
  Revert "Input: rmi4 - fix register descriptor address calculation"
  Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
  Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
2026-06-28 04:40:05 -07:00
Linus Torvalds
780d569e6c pwm: Changes for v7.2-rc1 (2nd batch)
Two more fixes that I managed to put into the public branch merged into
 next before my first PR but missed to include them in it. The first
 change is a relevant change that fixes misconfigurations due to a
 variable overflow. The 2nd is only cosmetic but very obviously an
 improvement.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEP4GsaTp6HlmJrf7Tj4D7WH0S/k4FAmpAE2gACgkQj4D7WH0S
 /k7tnAgAsjkBQWoav1MF8kyVzew+iIuVvBrtUPimzeMs2gzwC1czi/TPKCvZxGND
 XaPESmf51lC9AZuFd/2Wfvb2GydxA/wmsbVB0Q6ZBwLtS6/L4yiv3DpYN2to9yWN
 QvVHeVCBdSbMHOQXdG0iFbhMiLyUX5YwCwyZT2cuVUHb4gvNLuDuKbgSXX9Odh1R
 /p9C0afNMbdxuj2yRy+S8CM5Rl5v4yfBw6cswKX6w3uA+LnvksWuC8og7tEfFa/F
 Vdwy4csWeKHGm7jEP9o6iSlWYy+DMKf5Llop+yFLZV6Db6AXMlEpNOXJsGxEv95y
 qMTQFCGhepNWqVuUDDOOeUs60Asjpg==
 =0WY9
 -----END PGP SIGNATURE-----

Merge tag 'pwm/for-7.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux

Pull pwm fixes from Uwe Kleine-König:
 "Two more fixes that I managed to put into the public branch merged
  into next before my first pull request but missed to include them in
  it.

  The first change is a relevant change that fixes misconfigurations due
  to a variable overflow. The second is only cosmetic but very obviously
  an improvement"

* tag 'pwm/for-7.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
  pwm: rzg2l-gpt: Add missing newlines to dev_err_probe() messages
  pwm: rzg2l-gpt: Fix period_ticks type from u32 to u64
2026-06-27 13:48:12 -07:00
Linus Torvalds
f21df87320 additional fbdev fixes & cleanups for 7.2-rc1:
Fixes:
 - fbcon: fix NULL pointer dereference for a console without vc_data [Ian Bridges]
 - fbdev: fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var [Ian Bridges]
 
 Fixes in failure paths:
 - pm2fb: unwind write-cache setting on probe failure [Haoxiang Li]
 - goldfishfb: fail pan display on base-update timeout [Pengpeng Hou]
 - viafb: return error on DMA copy time-out [Pengpeng Hou]
 - fbcon: fix out-of-bounds read in error path of fbcon_do_set_font() [Mingyu Wang]
 - fbdev: fix modelist use-after-free in store_modes() [Ian Bridges]
 
 Code cleanup:
 - vga16fb: clean up platform_device_id table [Uwe Kleine-König]
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCakAKnwAKCRD3ErUQojoP
 X27+AQCPvMJUMScjO1dlGKkPnnIFiOWCU6AW1aM2m6T+qWrCTQEAnNi5CCI3JiLi
 6NCcyPm7/4R6tSXDm+UcWJ5tyzaNvww=
 =EBHb
 -----END PGP SIGNATURE-----

Merge tag 'fbdev-for-7.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev

Pull more fbdev updates from Helge Deller:
 "Fixes for generic fbdev & fbcon code for the handling of modelists
  and preventing a potential NULL ptr dereference in the console code.

  Fix missed cleanups in the error path of various fbdev drivers.

  And Uwe Kleine-König contributed a cleanup patch to use named
  initializers in the vga16fb driver"

* tag 'fbdev-for-7.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
  fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
  fbcon: fix NULL pointer dereference for a console without vc_data
  fbdev: fix use-after-free in store_modes()
  fbdev: viafb: return an error when DMA copy times out
  fbdev: goldfishfb: fail pan display on base-update timeout
  fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
  fbdev: pm2fb: unwind WC setup on probe failure
  fbdev: vga16fb: Drop unused assignment of platform_device_id driver data
2026-06-27 12:52:20 -07:00
Linus Torvalds
14923571e7 sound fixes for 7.2-rc1
A collection of small bug fixes accumulated over the last week.
 Most are device-specific fixes while there are a few core fixes as
 well.
 
 Here are the highlights:
 
 ALSA Core:
 - A fix for an uninitialised heap leak in ALSA sequencer core
 - A fix for error handling/resource leak in compress-offload API
 
 USB-audio:
 - A teardown-ordering fix in USB MIDI 2.0 to prevent use-after-free
 - Bounds and length checks for packet data in Native Instruments caiaq
   / Traktor Kontrol input parsers
 - Avoidance of expensive kobject path lookups in DualSense controller
   matches
 - Robustness/memory leak fixes for Qualcomm USB offload driver
 - Focusrite Control Protocol (FCP) NULL-pointer dereference fix and a
   new device quirk (ISA C8X)
 - Device-specific quirks for Yamaha CDS3000 and SC13A
 
 HD-Audio:
 - A bunch of quirks and mute/mic-mute LED fixups for various laptops
   (Acer, Clevo, Lenovo, HP)
 
 ASoC & SoundWire:
 - Avoid failing card registration if the device_link creation fails
 - A workaround for SoundWire randconfig build failures by making
   helper functions static inline
 - Corrected MCLK reference validation for CS530x codecs
 - Clean up of untested, problematic guard() macro replacements in
   Rockchip SAI driver
 - Fix for eDMA maxburst misalignment with channel count in Freescale
   ASRC
 - Miscellaneous hardware-specific fixes (qcom, rt5650, tlv320aic3x,
   tas2781/3)
 
 Others:
 - Bounds and length checks for packet data in Apple iSight
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmo+mnEOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE92VQ/+ItB+EBTpiba9YQYBrzUzq2R3BiNR/EZjU33G
 UMut1zQYQJ53eMmN8yMYc0GMbtk9dCFUAtRGPyQCNEHS6uFw51t3A4wlcXvIu1Sx
 kQqtyaDQ2jp98J72ms4WtN42o29MjcFmhBBcTb3Kw12T+OVTYYneccsGPsHqCXsZ
 RBjJFpDr0Xo1TfnOy9nt/UNUUIMJEtZ1gGlYBqzQgNoLeYH3+dRKBoX2qVAvhIcL
 FJnSGiDgyLpt6uucPAAeIzGHawQXW4ej7XY4S8cLscsB7mY7VEtPFIMx4bN1QYIO
 Ioj2P9KLG4/KYOV8oRQ6kzYTwtO7St9Kd/+xpU5Divjxf6TqRGlv/hlQCTBBZPLq
 RVUsEiE36UlSuipyruK34KubtVkbqUgUjBiPygFr6cLKb6fc6sjWrK5P8KUtN860
 8q1froUK43gwdVcdmLgrMbFCspE+KUp3xzSDh9tcVq6Ffw+otuuC0cJeVG4j+GOf
 xntsUqlAX6XSudTvTfa1pqvQmynBqvBy4wW9yrRfvEJ6eJqRlT17Sbs6AzpeLE4k
 dpeHlHwHtk5kfEGkYarJ3CEDw1GfHdLfQ6B6lBmCKq6DwnTZbq+lX5C3wB+OXVom
 xn5enCuaygVnXs6RF6DP3KlSvLoCJ09BEehkERxVg1uyVnGkioXXwNU8vdjkj2Qd
 srITNeo=
 =hJ5w
 -----END PGP SIGNATURE-----

Merge tag 'sound-fix-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A collection of small bug fixes accumulated over the last week.
  Most are device-specific fixes while there are a few core fixes as
  well.

  Here are the highlights:

  ALSA Core:
   - A fix for an uninitialised heap leak in ALSA sequencer core
   - A fix for error handling/resource leak in compress-offload API

  USB-audio:
   - A teardown-ordering fix in USB MIDI 2.0 to prevent use-after-free
   - Bounds and length checks for packet data in Native Instruments
     caiaq / Traktor Kontrol input parsers
   - Avoidance of expensive kobject path lookups in DualSense controller
     matches
   - Robustness/memory leak fixes for Qualcomm USB offload driver
   - Focusrite Control Protocol (FCP) NULL-pointer dereference fix and a
     new device quirk (ISA C8X)
   - Device-specific quirks for Yamaha CDS3000 and SC13A

  HD-Audio:
   - A bunch of quirks and mute/mic-mute LED fixups for various laptops
     (Acer, Clevo, Lenovo, HP)

  ASoC & SoundWire:
   - Avoid failing card registration if the device_link creation fails
   - A workaround for SoundWire randconfig build failures by making
     helper functions static inline
   - Corrected MCLK reference validation for CS530x codecs
   - Clean up of untested, problematic guard() macro replacements in
     Rockchip SAI driver
   - Fix for eDMA maxburst misalignment with channel count in Freescale
     ASRC
   - Miscellaneous hardware-specific fixes (qcom, rt5650, tlv320aic3x,
     tas2781/3)

  Others:
   - Bounds and length checks for packet data in Apple iSight"

* tag 'sound-fix-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (46 commits)
  ALSA: FCP: Fix NULL pointer dereference in interface lookup
  ALSA: hda/realtek: Update Acer Nitro ANV15-41 quirk to enable mute LED
  ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count
  ASoC: codecs: pcm512x: only print info once on no sclk
  ASoC: tas2781: Update default register address to TAS2563
  ALSA: firewire: isight: bound the sample count to the packet payload
  ALSA: usb-audio: qcom: Free QMI handle
  ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk
  ALSA: usb-audio: avoid kobject path lookup in DualSense match
  ALSA: hda/realtek: Add quirk for Acer Nitro ANV15-41
  ASoC: soc-core: Don't fail if device_link could not be created
  ASoC: rockchip: rockchip_sai: #include <linux/platform_device.h> explicitly
  ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
  ASoC: rt5575: Use __le32 for SPI burst write address
  ASoC: tas2783: Update loaded firmware names to linux-firmware 20260519
  ASoC: SDCA: Validate written enum value in ge_put_enum_double()
  ASoC: realtek: Add back local call to sdw_show_ping_status()
  ASoC: ti: Add back local call to sdw_show_ping_status()
  ASoC: max98373: Add back local call to sdw_show_ping_status()
  ASoC: es9356: Add back local call to sdw_show_ping_status()
  ...
2026-06-27 12:15:23 -07:00
Linus Torvalds
4bf54e4752 i2c-fixes for v7.2-rc1
- i801: fix error path in smbus transfer
 - mpc: fix timeout calculation
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCaj9vnAAKCRDaeAVmJtMt
 bq7xAQC61/OYC2g4MO1j5t9k3neRaI6LOWEzvs9j0lpFSTidBwD+Nmw1VGC4Qs8B
 2CmWHWtkbLKYpBtHIBB+2JkilMTZZQo=
 =YcGr
 -----END PGP SIGNATURE-----

Merge tag 'i2c-fixes-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux

Pull i2c fixes from Andi Shyti:

 - i801: fix error path in smbus transfer

 - mpc: fix timeout calculation

* tag 'i2c-fixes-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
  i2c: i801: fix hardware state machine corruption in error path
  i2c: mpc: Fix timeout calculations
2026-06-27 11:33:30 -07:00