--- /dev/null
+From cc27314c67516c138ee3829197d1c3b998e29fae Mon Sep 17 00:00:00 2001
+From: Koen Koning <koen.koning@linux.intel.com>
+Date: Fri, 13 Feb 2026 16:20:47 +0100
+Subject: gpu: Fix uninitialized buddy for built-in drivers
+
+From: Koen Koning <koen.koning@linux.intel.com>
+
+commit cc27314c67516c138ee3829197d1c3b998e29fae upstream.
+
+Move buddy to the start of the link order, so its __init runs before any
+other built-in drivers that may depend on it. Otherwise, a built-in
+driver that tries to use the buddy allocator will run into a kernel NULL
+pointer dereference because slab_blocks is uninitialized.
+
+Specifically, this fixes drm/xe (as built-in) running into a kernel
+panic during boot, because it uses buddy during device probe.
+
+Fixes: ba110db8e1bc ("gpu: Move DRM buddy allocator one level up (part two)")
+Cc: Joel Fernandes <joelagnelf@nvidia.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: intel-xe@lists.freedesktop.org
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Tested-by: Peter Senna Tschudin <peter.senna@linux.intel.com>
+Signed-off-by: Koen Koning <koen.koning@linux.intel.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Link: https://patch.msgid.link/20260213152047.179628-1-koen.koning@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/Makefile
++++ b/drivers/gpu/Makefile
+@@ -2,8 +2,9 @@
+ # drm/tegra depends on host1x, so if both drivers are built-in care must be
+ # taken to initialize them in the correct order. Link order is the only way
+ # to ensure this currently.
++# Similarly, buddy must come first since it is used by other drivers.
++obj-$(CONFIG_GPU_BUDDY) += buddy.o
+ obj-y += host1x/ drm/ vga/ tests/
+ obj-$(CONFIG_IMX_IPUV3_CORE) += ipu-v3/
+ obj-$(CONFIG_TRACE_GPU_MEM) += trace/
+ obj-$(CONFIG_NOVA_CORE) += nova-core/
+-obj-$(CONFIG_GPU_BUDDY) += buddy.o
--- /dev/null
+From 7d36a4a8bf62dc508bc6bb4b59727aec25064ca5 Mon Sep 17 00:00:00 2001
+From: Gal Pressman <gal@nvidia.com>
+Date: Thu, 25 Dec 2025 15:27:15 +0200
+Subject: net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query
+
+From: Gal Pressman <gal@nvidia.com>
+
+commit 7d36a4a8bf62dc508bc6bb4b59727aec25064ca5 upstream.
+
+The mlx5_query_mcia() function unconditionally dereferences the status
+pointer to store the MCIA register status value.
+However, mlx5e_get_module_id() passes NULL since it doesn't need the
+status value.
+
+Add a NULL check before dereferencing the status pointer to prevent a
+NULL pointer dereference.
+
+Fixes: 2e4c44b12f4d ("net/mlx5: Refactor EEPROM query error handling to return status separately")
+Signed-off-by: Gal Pressman <gal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Link: https://patch.msgid.link/20251225132717.358820-4-mbloch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/port.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+@@ -393,9 +393,11 @@ static int mlx5_query_mcia(struct mlx5_c
+ if (err)
+ return err;
+
+- *status = MLX5_GET(mcia_reg, out, status);
+- if (*status)
++ if (MLX5_GET(mcia_reg, out, status)) {
++ if (status)
++ *status = MLX5_GET(mcia_reg, out, status);
+ return -EIO;
++ }
+
+ ptr = MLX5_ADDR_OF(mcia_reg, out, dwords);
+ memcpy(data, ptr, size);
--- /dev/null
+From 5ccde4c81e843ab6b3a324c8e2aa96d9b1270a1a Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Fri, 16 Jan 2026 00:49:24 +0000
+Subject: net: stmmac: fix dwmac4 transmit performance regression
+
+From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+
+commit 5ccde4c81e843ab6b3a324c8e2aa96d9b1270a1a upstream.
+
+dwmac4's transmit performance dropped by a factor of four due to an
+incorrect assumption about which definitions are for what. This
+highlights the need for sane register macros.
+
+Commit 8409495bf6c9 ("net: stmmac: cores: remove many xxx_SHIFT
+definitions") changed the way the txpbl value is merged into the
+register:
+
+ value = readl(ioaddr + DMA_CHAN_TX_CONTROL(dwmac4_addrs, chan));
+- value = value | (txpbl << DMA_BUS_MODE_PBL_SHIFT);
++ value = value | FIELD_PREP(DMA_BUS_MODE_PBL, txpbl);
+
+With the following in the header file:
+
+ #define DMA_BUS_MODE_PBL BIT(16)
+-#define DMA_BUS_MODE_PBL_SHIFT 16
+
+The assumption here was that DMA_BUS_MODE_PBL was the mask for
+DMA_BUS_MODE_PBL_SHIFT, but this turns out not to be the case.
+
+The field is actually six bits wide, buts 21:16, and is called
+TXPBL.
+
+What's even more confusing is, there turns out to be a PBLX8
+single bit in the DMA_CHAN_CONTROL register (0x1100 for channel 0),
+and DMA_BUS_MODE_PBL seems to be used for that. However, this bit
+et.al. was listed under a comment "/* DMA SYS Bus Mode bitmap */"
+which is for register 0x1004.
+
+Fix this up by adding an appropriately named field definition under
+the DMA_CHAN_TX_CONTROL() register address definition.
+
+Move the RPBL mask definition under DMA_CHAN_RX_CONTROL(), correctly
+renaming it as well.
+
+Also move the PBL bit definition under DMA_CHAN_CONTROL(), correctly
+renaming it.
+
+This removes confusion over the PBL fields.
+
+Fixes: 8409495bf6c9 ("net: stmmac: cores: remove many xxx_SHIFT definitions")
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Bisected-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Link: https://lore.kernel.org/51859704-57fd-4913-b09d-9ac58a57f185@bootlin.com
+Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Link: https://patch.msgid.link/E1vgY1k-00000003vOC-0Z1H@rmk-PC.armlinux.org.uk
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c | 8 ++++----
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h | 7 ++++---
+ 2 files changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
+@@ -76,7 +76,7 @@ static void dwmac4_dma_init_rx_chan(stru
+ u32 rxpbl = dma_cfg->rxpbl ?: dma_cfg->pbl;
+
+ value = readl(ioaddr + DMA_CHAN_RX_CONTROL(dwmac4_addrs, chan));
+- value = value | FIELD_PREP(DMA_BUS_MODE_RPBL_MASK, rxpbl);
++ value = value | FIELD_PREP(DMA_CHAN_RX_CTRL_RXPBL_MASK, rxpbl);
+ writel(value, ioaddr + DMA_CHAN_RX_CONTROL(dwmac4_addrs, chan));
+
+ if (IS_ENABLED(CONFIG_ARCH_DMA_ADDR_T_64BIT) && likely(dma_cfg->eame))
+@@ -97,7 +97,7 @@ static void dwmac4_dma_init_tx_chan(stru
+ u32 txpbl = dma_cfg->txpbl ?: dma_cfg->pbl;
+
+ value = readl(ioaddr + DMA_CHAN_TX_CONTROL(dwmac4_addrs, chan));
+- value = value | FIELD_PREP(DMA_BUS_MODE_PBL, txpbl);
++ value = value | FIELD_PREP(DMA_CHAN_TX_CTRL_TXPBL_MASK, txpbl);
+
+ /* Enable OSP to get best performance */
+ value |= DMA_CONTROL_OSP;
+@@ -122,7 +122,7 @@ static void dwmac4_dma_init_channel(stru
+ /* common channel control register config */
+ value = readl(ioaddr + DMA_CHAN_CONTROL(dwmac4_addrs, chan));
+ if (dma_cfg->pblx8)
+- value = value | DMA_BUS_MODE_PBL;
++ value = value | DMA_CHAN_CTRL_PBLX8;
+ writel(value, ioaddr + DMA_CHAN_CONTROL(dwmac4_addrs, chan));
+
+ /* Mask interrupts by writing to CSR7 */
+@@ -140,7 +140,7 @@ static void dwmac410_dma_init_channel(st
+ /* common channel control register config */
+ value = readl(ioaddr + DMA_CHAN_CONTROL(dwmac4_addrs, chan));
+ if (dma_cfg->pblx8)
+- value = value | DMA_BUS_MODE_PBL;
++ value = value | DMA_CHAN_CTRL_PBLX8;
+
+ writel(value, ioaddr + DMA_CHAN_CONTROL(dwmac4_addrs, chan));
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.h
+@@ -32,8 +32,6 @@
+
+ /* DMA SYS Bus Mode bitmap */
+ #define DMA_BUS_MODE_SPH BIT(24)
+-#define DMA_BUS_MODE_PBL BIT(16)
+-#define DMA_BUS_MODE_RPBL_MASK GENMASK(21, 16)
+ #define DMA_BUS_MODE_MB BIT(14)
+ #define DMA_BUS_MODE_FB BIT(0)
+
+@@ -126,18 +124,21 @@ static inline u32 dma_chanx_base_addr(co
+ #define DMA_CHAN_STATUS(addrs, x) (dma_chanx_base_addr(addrs, x) + 0x60)
+
+ /* DMA Control X */
++#define DMA_CHAN_CTRL_PBLX8 BIT(16)
+ #define DMA_CONTROL_SPH BIT(24)
+ #define DMA_CONTROL_MSS_MASK GENMASK(13, 0)
+
+ /* DMA Tx Channel X Control register defines */
+ #define DMA_CONTROL_EDSE BIT(28)
++#define DMA_CHAN_TX_CTRL_TXPBL_MASK GENMASK(21, 16)
+ #define DMA_CONTROL_TSE BIT(12)
+ #define DMA_CONTROL_OSP BIT(4)
+ #define DMA_CONTROL_ST BIT(0)
+
+ /* DMA Rx Channel X Control register defines */
+-#define DMA_CONTROL_SR BIT(0)
++#define DMA_CHAN_RX_CTRL_RXPBL_MASK GENMASK(21, 16)
+ #define DMA_RBSZ_MASK GENMASK(14, 1)
++#define DMA_CONTROL_SR BIT(0)
+
+ /* Interrupt status per channel */
+ #define DMA_CHAN_STATUS_REB GENMASK(21, 19)
projects / thirdparty / kernel / stable-queue.git / commitdiff
