On 10/20/26 11:19, Yili Zhang wrote:
> Hi Sumit, Christian,
>
> Gentle ping on this patch.
>
> It has two Reviewed-by tags from Dawid and Leon, but I don't see the fix in
> v7.3. Since the 7.4 merge window is now open, could it be queued for v7.4?
>
> I'm happy to resend with the collected Reviewed-by tags if that helps.
I've just pushed it to drm-misc-fixes.
Sorry I'm way to busy at the moment.
Regards,
Christian.
>
> Thanks,
> Yili
On 10/20/26 09:14, Philipp Stanner wrote:
> On Tue, 2026-07-21 at 09:21 +0100, André Draszik wrote:
>>
>
> […]
>
>>
>>
>> ---
>> v3:
>> - Philipp: update kerneldoc, add Fixes:
>>
>> v2: new patch
>> ---
>> drivers/gpu/drm/drm_crtc.c | 15 ++++++++++++---
>> 1 file changed, 12 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
>> index 63ead8ba6756..e8e80c936852 100644
>> --- a/drivers/gpu/drm/drm_crtc.c
>> +++ b/drivers/gpu/drm/drm_crtc.c
>> @@ -493,14 +493,23 @@ EXPORT_SYMBOL(__drmm_crtc_alloc_with_planes);
>> * drm_crtc_cleanup - Clean up the core crtc usage
>> * @crtc: CRTC to cleanup
>> *
>> - * This function cleans up @crtc and removes it from the DRM mode setting
>> - * core. Note that the function does *not* free the crtc structure itself,
>> - * this is the responsibility of the caller.
>> + * This function cleans up @crtc and removes it from the DRM mode setting core,
>> + * after first waiting an RCU grace period to ensure @crtc->dev can safely be
>> + * dereferenced by our dma_fence_ops.
>> + *
>> + * Note that the function does *not* free the crtc structure itself, this is the
>> + * responsibility of the caller.
>> */
>> void drm_crtc_cleanup(struct drm_crtc *crtc)
>> {
>> struct drm_device *dev = crtc->dev;
>>
>> + /* Ensure our dma_fence_ops remain valid for an RCU grace period after
>> + * the fence is signaled. This is necessary because our dma_fence_ops
>> + * dereference crtc->dev.
>> + */
>> + synchronize_rcu();
>> +
>> /* Note that the crtc_list is considered to be static; should we
>> * remove the drm_crtc at runtime we would have to decrement all
>> * the indices on the drm_crtc after us in the crtc_list.
>
>
> Seems we forgot [1] this patch. Sorry about that.
>
> This fix also looks fine to me (for now) since it's what the dma_fence
> contract currently demands.
>
> I'm a bit nervous about a synchronize_rcu() being in every cleanup
> path, but I suspect it's the most reasonable thing to do now.
>
> Let's wait a day or two to see if anyone has fundamental objections.
> Could someone with some CRTC knowledge give it an R-b? Otherwise I'd
> push it this week.
I just picked them up and I'm about to push them to drm-misc-fixes.
Regards,
Christian.
>
>
> Regards,
> Philipp
>
>
> [1] https://lore.kernel.org/dri-devel/73fc12734386c9bebc9cf6d3cea4c5f8e125255e.…
PCI P2PDMA applies Request and Completion Redirect throughout both paths.
This misclassifies asymmetric and nested switches, and reports one answer
for every kind of TLP.
Three ACS controls act on TLP attributes the Requester chooses rather
than on the topology: Translation Blocking and Direct Translated P2P act on
a Request's Address Type, and Completion Redirect skips Completions carrying
Relaxed Ordering.
Evaluate each direction at the path divergence, decide every class from the
one walk, and treat a client with ATS enabled as translating unless its
driver declares per-mapping ATS.
This completes the P2PDMA side; dma-buf and mlx5 follow separately.
Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com>
---
Changes in v11:
- Applied the client ATS policy in pci_p2pdma_distance_many() too, as
local Sashiko pointed out.
- Read the ATS Enable bit once per query, so the class and the ATS policy
always agree.
- Documented that pcim_p2pdma_set_ats_per_mapping() needs a successful
pcim_p2pdma_init().
- The path diagnostics no longer read ACS Control or the bridge bus range,
and they report a failed cache store.
- Added a KUnit case for Direct Translated P2P without a redirect.
- Clarified the Relaxed Ordering and diagnostics commit messages.
- Honored device-specific ACS redirection, such as Zhaoxin Downstream
Ports, in a new first patch with a KUnit case, as local Sashiko
pointed out. Relaxed Ordering Completions are redirected at such a
port too.
- Clarified in the documentation that a quirk also redirects Relaxed
Ordering Completions and that Translation Blocking applies only to
upstream Requests, and labelled the ACS routing debug line with its
class, as local Sashiko pointed out.
- Treated ACS registers that read as all ones as unreadable, and named
ports that a quirk redirects instead of suggesting
pci=disable_acs_redir= for them, as local Sashiko pointed out.
- Ignored ACS quirks of endpoints, which only describe traffic between
their own functions.
- Link to v10: https://patch.msgid.link/20261012-fix-p2p-acs-v4-0-v10-0-6ffe7b7a4517@nvidi…
Changes in v10:
- Fixed the Relaxed Ordering description: a Completion carries the
attribute of its Request (PCIe r7.0 sec 2.2.9.1).
- Used the PCIe terms Requester and Completer for TLPs, ACS and ports;
client and provider remain for P2PDMA objects.
- Rebased on pci/p2pdma, which includes the prerequisite P2PDMA fixes.
- Added a topology example to the path divergence patch.
- Removed a repeated sentence from the disable_acs_redir documentation.
- Explained the path divergence in the documentation.
- Link to v9: https://patch.msgid.link/20261001-fix-p2p-acs-v4-0-v9-0-1a8e0f50ddd9@nvidia…
Changes in v9:
- Removed dmabuf patches for now.
- Removed mlx5 per-mapping ATS declaration for now; it comes back with
the dmabuf patches.
- Link to v8: https://patch.msgid.link/20260928-fix-p2p-acs-v4-0-v8-0-404453b9c435@nvidia…
Changes in v8:
- Added extra Reviewed-by from Logan.
- Added patches to take care of ATS per-device vs. per-mapping option
- Link to v7: https://patch.msgid.link/20260920-fix-p2p-acs-v4-0-v7-0-ca0828ab697c@nvidia…
Changes in v7:
- Removed "Document pdev->p2pdma lifetime rules" patch, it gives nothing
after p2pmem fix.
- Split dmabuf patch.
- Tushar retested the series, so added his Tested-by.
- Added Logan's ROB tags and fixed minor documentation issues pointed
by him.
- Link to v6: https://lore.kernel.org/all/20260914-fix-p2p-acs-v4-0-v6-0-5ef07ec9ef06@nvi…
Changes in v6:
- Changed DMABUF to use callbacks and not directly stored pointer.
- Link to v5: https://patch.msgid.link/20260910-fix-p2p-acs-v4-0-v5-0-856087f63c0d@nvidia…
Changes in v5:
- Rebase on the posted fixes.
- Dropped tags from changed patches.
- Remove Egress Control Vector interpretation and coverage.
- Keep enabled Egress Control conservative as a Request redirect.
- Use pci_dbg()/dev_dbg() for diagnostics and drop the "debug" prefix.
- Removed code comments from "Document the pdev->p2pdma lifetime and RCU
rules" patch and reduced description to actual lifetime explanation.
- Added note that Linux assumes that TLPs are in strict-ordering and
untranslated.
- Added code to calculate p2p paths per-TLP type.
- Converted mlx5 to use that new proposed API.
- Link to https://patch.msgid.link/20260821-fix-p2p-acs-v4-0-v4-0-94426b96de73@nvidia…
Changes in v4:
- Reject ACS Violations and unreadable routing state instead of treating
them as host-bridge redirects
- Added Tested-by tags from Tushar Dave
- Added support to asymmetric ACS routing
- Limited redirect checks to the two ports at the path divergence
- Added standalone ACS routing diagnostics for hardware retesting
- Dropped " PCI: Account for Direct Translated P2P in ACS isolation checks" patch
- Link to v3: https://patch.msgid.link/20260811-fix-p2p-acs-v3-0-efc488ee7c03@nvidia.com
Changes in v3:
- Fixed pci_p2pdma_add_resource() error unwinding
- Made pdev->p2pdma teardown wait unconditionally for RCU readers
- Restricted pci_p2pmem_find_many() to pool-backed providers
- Documented the pdev->p2pdma lifetime and RCU rules
- Fixed calc_map_type_and_dist() handling of the verbose argument
- Required the ACS port and target to share a bus before indexing the
Egress Control Vector
- Gave pci_acs_enabled() and pci_acs_path_enabled() a scope, so the ACS
Direct Translated P2P rule no longer stops pci_enable_pasid() from
enabling PASID
- Dropped "Report ACS ports when the paths share no upstream bridge":
the mapping type cannot change without a shared upstream bridge, so
the pci=disable_acs_redir= hint was not actionable there and the ACS
walk only cost config space reads
- Folded the Request Redirect rule into pci_acs_rr_ineffective(), so
pci_acs_flags_enabled() and the Intel SPT PCH quirk share one copy
- Renamed pci_acs_egress_ctrl_set() to pci_acs_egress_ctrl_is_set(), it
reads the bit rather than setting it
- Reworded the blocked-path warning: ACS may also leave the direct route
indeterminate rather than blocked
- Added KUnit coverage for the shared-bus guard, a device with no ACS
capability and an unreadable ACS Control register
- Added the missing Fixes: tags, a second one on the
pci_p2pdma_add_resource() unwinding fix (the dangling devres action
dates to f58ef9d1d135) and one on the Egress Control isolation change
- Link to v2: https://patch.msgid.link/20260806-fix-p2p-acs-v2-0-0cec14812965@nvidia.com
Changes in v2:
- Added Logan's ROB tags
- Added commas in Documentation patch
- Link to v1: https://patch.msgid.link/20260802-fix-p2p-acs-v1-0-a7c5eb64fff6@nvidia.com
---
Leon Romanovsky (19):
PCI/P2PDMA: Honor device-specific ACS redirection
PCI/P2PDMA: Document the TLP attribute assumptions
PCI/P2PDMA: Derive routing from directional ACS controls
PCI: Reject unreadable ACS controls in isolation checks
PCI/P2PDMA: Evaluate ACS controls at the path divergence
PCI/P2PDMA: Document directional ACS routing
PCI/P2PDMA: Collect the path's ACS controls before deciding
PCI/P2PDMA: Answer routing per TLP class
PCI/P2PDMA: Route Relaxed Ordering Completions directly
PCI/P2PDMA: Reject Translated Requests blocked by Translation Blocking
PCI/P2PDMA: Route Translated Requests under Direct Translated P2P
PCI/P2PDMA: Log detailed ACS routing diagnostics
PCI/P2PDMA: Add KUnit tests for the ACS routing decisions
PCI/P2PDMA: Test the ACS P2P routing walk
PCI: Add KUnit coverage for ACS isolation checks
PCI/P2PDMA: Document TLP-class routing
PCI/P2PDMA: Let a client declare that it selects ATS per mapping
PCI/P2PDMA: Evaluate the ATS path for clients with ATS enabled
PCI/P2PDMA: Test the routing of clients with ATS enabled
Documentation/admin-guide/kernel-parameters.txt | 11 +-
Documentation/driver-api/pci/p2pdma.rst | 105 ++
drivers/pci/Kconfig | 15 +
drivers/pci/Makefile | 1 +
drivers/pci/p2pdma.c | 942 +++++++++++++++--
drivers/pci/pci.c | 8 +-
drivers/pci/pci.h | 57 ++
drivers/pci/pci_acs_test.c | 1225 +++++++++++++++++++++++
drivers/pci/quirks.c | 8 +-
include/linux/pci-p2pdma.h | 12 +-
10 files changed, 2292 insertions(+), 92 deletions(-)
---
base-commit: 36038f0e8377ef316b723d0d85b1510bc64069ab
change-id: 20260821-fix-p2p-acs-v4-0-e72455e3a261
Best regards,
--
Leon Romanovsky <leonro(a)nvidia.com>
On 10/16/26 22:26, Karl Mehltretter wrote:
> On Tue, Feb 17, 2026 at 08:11:34PM -0400, Jason Gunthorpe wrote:
>> + match_args.attach = attach;
>> + if (dmabuf->ops->match_mapping) {
>> + ret = dmabuf->ops->match_mapping(&match_args);
>> + }
>> +
>> attach->dmabuf = dmabuf;
>> attach->importer_ops = importer_ops;
>> attach->importer_priv = importer_priv;
>
> I may misunderstand the intended contract. match_mapping() runs while the
> attachment is still zeroed and without dmabuf->resv held.
>
> Patch 11's amdgpu callback needs importer_ops and importer_priv, so its XGMI
> match cannot work here. Patch 12's VFIO callback asserts dmabuf->resv and
> reads priv->vdev, which cleanup changes under that lock.
>
> Should the core initialize the attachment and hold dmabuf->resv for
> match_mapping(), or should callbacks avoid attachment and lock-protected
> state?
Right. This completely misplaced.
The matching can't be done at attachment time, but rather needs to be done before creating a mapping while holding the resv lock so that the matching decision can't change.
Regards,
Christian.
>
> Thanks,
> Karl
On Mon, Oct 19, 2026 at 09:14:07AM +0200, Karl Mehltretter wrote:
> UVC and vivid access imported DMA-BUFs with the CPU without cache
> synchronization. On a Pi 400, captured data remained in the CPU cache
> while physical RAM was stale.
>
> Add an opt-in queue flag to bracket CPU access from buf_prepare() through
> buf_finish(). The allocator cannot imply CPU use because some vb2-vmalloc
> drivers pass buffers to hardware. Patch 1 balances finish operations in
> VIDIOC_REMOVE_BUFS so removing prepared buffers closes this interval.
This seems completely wrong.
> This follows the per-queue flag proposed here:
> https://lists.openwall.net/linux-kernel/2024/06/20/236
>
> Based on Linux 7.3. Tests cover the same code on these earlier bases:
>
> - Pi 400, 7.3-rc4, all four patches: eight 640x480 YUYV frames per run,
> imported CMA DMA-BUFs with a DRM device mapping:
>
> Path Runs Stale frames
> UVC, vb2-vmalloc 12 0/96
> vivid, vb2-vmalloc 12 0/96
> vivid, vb2-dma-contig 12 0/96
>
> All six lifecycle cases passed with both vivid allocators. Read-only
> output USERPTR passed. The test added no warnings or failed CPU-access
> callbacks. A control without the DRM mapping found 4/16 stale frames.
>
> - SAM9X75 (ARMv5), 6.18 backport of all four patches: the baseline
> PREPARE_BUF/REMOVE_BUFS imbalance was fixed. USERPTR and six lifecycle
> cases passed. All 128 vivid and 96 UVC frames matched RAM, with 100/100
> begin/end calls. The baseline was already coherent.
>
> - BeagleV Ahead (RISC-V), 7.3-rc7, patches 1, 2 and 4: read-only USERPTR,
> six traced lifecycle cases and 60 repeats passed with balanced callbacks
> and no kernel diagnostics. A vendor 5.10 backport of patches 2 and 3
> captured 96 UVC frames without stale data, with 100/100 begin/end calls.
> Its baseline was already coherent.
>
> Karl Mehltretter (4):
> media: videobuf2: finish prepared buffers in VIDIOC_REMOVE_BUFS
> media: videobuf2: add opt-in DMA-BUF CPU access
> media: uvcvideo: synchronize imported DMA-BUFs for CPU access
> media: vivid: synchronize imported DMA-BUFs for CPU access
>
> .../media/common/videobuf2/videobuf2-core.c | 96 ++++++++++++++++++-
> .../common/videobuf2/videobuf2-dma-contig.c | 5 +-
> .../media/common/videobuf2/videobuf2-dma-sg.c | 5 +-
> .../common/videobuf2/videobuf2-vmalloc.c | 5 +-
> drivers/media/test-drivers/vivid/vivid-core.c | 1 +
> drivers/media/usb/uvc/uvc_queue.c | 1 +
> include/media/videobuf2-core.h | 12 ++-
> 7 files changed, 116 insertions(+), 9 deletions(-)
>
>
> base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
--
Regards,
Laurent Pinchart
On Thu, 1 Oct 2026 16:56:46 +0200
Olivier Moysan <olivier.moysan(a)foss.st.com> wrote:
> Add the STM32 Multi-function Digital Filter (MDF) core, serial interface
> and digital filter drivers. The MDF converts bitstreams from sigma-delta
> modulators or digital microphones into samples exposed through IIO.
>
> Audio: capture PDM microphones via cyclic DMA for an ASoC consumer.
> Support CIC scaling and filtering, synchronized and interleaving modes.
> Audio use case requires a DMIC filter, and a separate ASoC DAI.
>
> Analog: expose sigma-delta modulators as IIO voltage channels with
> direct reads or DMA buffering mode. STM32 timer triggers can be used as
> clock source.
> Analog use case requires an IIO backend for the SD modulator.
>
> Signed-off-by: Olivier Moysan <olivier.moysan(a)foss.st.com>
I'm not going to spend long on this today, but a few trivial things noted
from a quick glance.
> diff --git a/drivers/iio/adc/stm32-mdf-serial.c b/drivers/iio/adc/stm32-mdf-serial.c
> new file mode 100644
> index 000000000000..15a58cf833be
> --- /dev/null
> +++ b/drivers/iio/adc/stm32-mdf-serial.c
...
> +
> +int stm32_mdf_sitf_stop(struct stm32_mdf_sitf *sitf)
> +{
> + int ret = 0;
> +
> + spin_lock(&sitf->lock);
Use guard() for cases like this. Simplifies the flow and helps
readabilty as a result. Everyone loves an early return.
> +
> + if (!sitf->refcnt) {
> + dev_err(sitf->dev, "Unbalanced serial interface stop ?\n");
> + ret = -EPERM;
> + goto out;
> + } else {
> + sitf->refcnt--;
> + }
> +
> + if (!sitf->refcnt)
> + ret = regmap_clear_bits(sitf->regmap, MDF_SITFCR_REG, MDF_SITFCR_SITFEN);
> +
> +out:
> + spin_unlock(&sitf->lock);
> +
> + return ret;
> +}
> +EXPORT_SYMBOL_GPL(stm32_mdf_sitf_stop);
>
> +static int stm32_mdf_sitf_runtime_suspend(struct device *dev)
> +{
Add a comment on why you need these.
> + return 0;
> +}
> +
> +static int stm32_mdf_sitf_runtime_resume(struct device *dev)
> +{
> + return 0;
> +}
> diff --git a/drivers/iio/adc/stm32-mdf.h b/drivers/iio/adc/stm32-mdf.h
> new file mode 100644
> index 000000000000..7e403c26d4dc
> --- /dev/null
> +++ b/drivers/iio/adc/stm32-mdf.h
> @@ -0,0 +1,312 @@
> +/* SPDX-License-Identifier: GPL-2.0-or-later */
> +/*
> + * This file is part of STM32 MDF driver
> + *
> + * Copyright (C) 2023, STMicroelectronics - All Rights Reserved
I'd guess you'll modify it enough that this might need
an update!
> +/* MDF_SIDR: Size Identification Register */
> +#define MDF_SIDR_SID_MASK GENMASK(31, 0)
> +#define MDF_SIDR_SID(v) FIELD_PREP(MDF_SIDR_SID_MASK, v)
I'd not bother with the second macro. It is only a little
shorter than FIELD_PREP() in most case.
>
On Thu, 15 Oct 2026 08:36:35 +0000, Deep Shah wrote:
> Fix two lifetime bugs in the uverbs DMABUF export path. Patch 1 fixes
> leaked uobject and ufile references when the uverbs FD is closed first.
> Patch 2 fixes a use-after-free when dma-buf release races with ufile
> cleanup.
>
> Tested on mainline 4056b3c9d3c9 in x86_64 QEMU with KASAN and lockdep,
> using test-only siw export hooks. The unpatched kernel reproduces both
> bugs. Patch 1 fixes the leak, confirmed by tracing ufile release. With
> both patches, the same tests complete without KASAN or lockdep reports.
>
> [...]
Applied, thanks!
[1/2] RDMA/uverbs: Fix uobject leak in DMABUF release
https://git.kernel.org/rdma/rdma/c/4a953ee228f554
[2/2] RDMA/uverbs: Fix DMABUF use-after-free during ufile cleanup
https://git.kernel.org/rdma/rdma/c/2854f9025d4ef6
Best regards,
--
Leon Romanovsky <leon(a)kernel.org>
Hi Karl,
> Subject: Re: [PATCH v2] udmabuf: respect the device's maximum
> segment size
>
> On Tue, Sep 29, 2026 at 07:48:35AM +0100, Karl Mehltretter wrote:
> > get_sg_table() merges physically contiguous pages without accounting
> > for the mapping device's maximum segment size. This affects both
> > importer mappings and the udmabuf misc device mapping used for
> CPU
> > access.
> >
> > With DMA_API_DEBUG enabled, DMA_BUF_IOCTL_SYNC on a 64 MiB
> udmabuf
> > reports:
> >
> > DMA-API: misc udmabuf: mapping sg segment longer than device
> claims to
> > support [len=65884160] [max=65536]
> >
> > Use sg_alloc_table_from_pages_segment() with the mapping device's
> > maximum segment size. Return -EINVAL if the limit is smaller than
> > PAGE_SIZE because the page-based allocator cannot honor it.
> >
> > Before commit 5bf888673e0d ("udmabuf: Do not create malformed
> > scatterlists"), each entry covered one page.
> >
> > Fixes: 5bf888673e0d ("udmabuf: Do not create malformed
> scatterlists")
> > Reviewed-by: Jason Gunthorpe <jgg(a)nvidia.com>
> > Assisted-by: LLM
> > Signed-off-by: Karl Mehltretter <kmehltretter(a)gmail.com>
>
> Friendly ping on v2. It has Reviewed-by tags from Jason and Christian.
Will push this patch to drm-misc-next soon (in a day or two).
Thanks,
Vivek
>
> Thanks,
> Karl
On Thu, Oct 15, 2026 at 01:08:33PM +0530, Jayant Shekhar wrote:
> diff --git a/arch/arm64/boot/dts/qcom/hawi.dtsi b/arch/arm64/boot/dts/qcom/hawi.dtsi
> index 0926d880cb0c..58fcf42cbaba 100644
> --- a/arch/arm64/boot/dts/qcom/hawi.dtsi
> +++ b/arch/arm64/boot/dts/qcom/hawi.dtsi
> @@ -8235,4 +8235,63 @@ timer {
> <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
> <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>;
> };
> +
> + dcp: virtio@9be8000 {
> + compatible = "qcom,dcp-virtio", "virtio,mmio";
More slop.
At least you could ask your agent to TEST it. See internal guidelines
how to do it.
Best regards,
Krzysztof