linux.git/arch/powerpc/platforms/pseries, branch master

Merge tags 'dma-mapping-7.3-2026-08-24' and 'dma-mapping-7.3-2026-08-24-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux

2026-08-24T18:35:46+00:00

Pull dma-mapping updates from Marek Szyprowski:

 - swiotlb:
     - new configuration option for the default pool size
       (Jagadeesh Pagadala)
     - reduce overhead for high watermark tracking (chenhuguanshen)

 - minor code cleanups and improvements (Vova Sharaienko, Honglei Huang
   and Marek Szyprowski)

 - add proper tracking of the shared DMA state through direct, pool and
   swiotlb paths (Aneesh Kumar K.V)

   This is important for confidential-computing

* tag 'dma-mapping-7.3-2026-08-24' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:
  dma/swiotlb: decouple high watermark tracking from CONFIG_DEBUG_FS
  MAINTAINERS: update tree for DMA MAPPING HELPERS
  dma/swiotlb: introduce Kconfig option for compile-time default pool size
  dma-direct: Improve readability of the dma_direct_map_sg() for P2PDMA case
  iommu/dma: simplify dma_iova_destroy() and drop the free_iova helper
  dma-coherent: use KiB in DMA allocation logs
  dma-coherent: fix spacing coding style issue

* tag 'dma-mapping-7.3-2026-08-24-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: (23 commits)
  swiotlb: remove unused SWIOTLB_FORCE flag
  dma: swiotlb: handle set_memory_decrypted() failures
  dma: swiotlb: free dynamic pools from process context
  dma-direct: rename ret to cpu_addr in alloc helpers
  dma-direct: select DMA address encoding from __DMA_ATTR_ALLOC_CC_SHARED
  dma-direct: set decrypted flag for remapped DMA allocations
  dma-direct: make dma_direct_map_phys() honor DMA_ATTR_CC_SHARED
  dma-direct: Move dma_direct_map_phys() to dma/direct.c
  dma-direct: pass attrs to dma_capable() for DMA_ATTR_CC_SHARED checks
  dma-mapping: make dma_pgprot() honor __DMA_ATTR_ALLOC_CC_SHARED
  dma: swiotlb: track pool encryption state and honor DMA_ATTR_CC_SHARED
  dma: swiotlb: pass mapping attributes by reference
  dma-pool: track decrypted atomic pools and select them via attrs
  dma-direct: use __DMA_ATTR_ALLOC_CC_SHARED in alloc/free paths
  dma-mapping: Add internal shared allocation attribute
  coco: arm64: s390: powerpc: Mark secure guests with CC_ATTR_GUEST_MEM_ENCRYPT
  dma-direct: swiotlb: handle swiotlb alloc/free outside __dma_direct_alloc_pages
  s390: Expose protected virtualization through cc_platform_has()
  swiotlb: Preserve allocation virtual address for dynamic pools
  dma: free atomic pool pages by physical address
  ...

Merge tag 'powerpc-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

2026-08-18T19:08:13+00:00

Pull powerpc updates from Madhavan Srinivasan:

 - Enable Rust for ppc64le

 - ppc4xx gpio driver updates

 - Add power12 base enablement support

 - Validate arch_compat against host compatibility mode

 - Simplify bootx_scan_dt_build_struct() in powermac platform

 - Implement get_direction() in cpm2

 - Use cpu_relax() in ps3_create_spu()

 - Add NULL guard for cause_ipi in smp_muxed_ipi_message_pass

 - Fixes to handle pseries watchdogs in kdump path

 - Fix missing r2 clobber in PCREL inline assembly

 - Set GPIO chip parent on ppc44x

 - KVM: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl

 - KVM: Use generic xfer to guest work function

 - Enable to run posix cpu timers in task context

 - Misc fixes and cleanups

Thanks to Aditya Gupta, Alice Ryhl, Amit Machhiwal, Andrew Morton,
Anushree Mathur, Athira Rajeev, Bartosz Golaszewski, Cédric Le Goater,
Christian König, Christophe Leroy (CS GROUP), Gary Guo, Gaurav Batra,
Gautam Menghani, Gou Hao, Hari Bathini, Harsh Prateek Bora, jiazhenyuan,
Jinjie Ruan, Link Mauve, Linus Walleij, Mahesh Kumar G Mahesh
Salgaonkar, Michael Walle, Michal Suchánek, Mukesh Kumar Chaurasiya
(IBM), Nicholas Piggin, Nikhil Kumar Singh, Praveen K Pandey, Ritesh
Harjani (IBM), Rosen Penev, Saket Kumar Bhaskar, Shrikanth Hegde,
Sourabh Jain, Thorsten Blum, Vaibhav Jain, Venkat Rao Bagalkote, Vishal
Chourasia, Wentao Guan, and Yanfei Xu.

* tag 'powerpc-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (62 commits)
  powerpc/pseries/iommu: switch to Default DMA window during kdump
  powerpc/configs: enable CONFIG_RAS to fix EDAC support
  KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl
  KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV
  KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM
  KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl
  gpio: ppc44x: use dev_name() for chip label
  gpio: ppc44x: fix undefined behavior in GPIO_MASK2 macro
  gpio: ppc44x: drop PPC-specific IO helpers
  gpio: ppc44x: Convert GPIO to generic MMIO
  gpio: ppc44x: Use platform resource helper for GPIO MMIO
  gpio: ppc44x: Use module platform driver helper for GPIO
  gpio: ppc44x: update all 4xx to 44x
  gpio: move ppc4xx gpio driver from arch/powerpc to drivers/gpio
  KVM: PPC: Use min() in kvm_vm_ioctl_check_extension()
  KVM: PPC: booke: Use min() in watchdog_next_timeout()
  powerpc/perf: Add power12 Base Performance Monitoring support
  powerpc: Add Power12 architected mode
  powerpc: Add Power12 raw mode
  powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation
  ...

powerpc/pseries/iommu: switch to Default DMA window during kdump

2026-08-11T05:02:18+00:00

In PowerPC (pseries) a non-virtualized adapter will have 2 DMA windows -
2GB default and a larger Dynamic DMA Window (DDW). DDW is large enough to
map total RAM to a device.

During normal functioning of OS, since RAM is pre-mapped, 2GB default
window is not used. The only scenario it might get used is when buffers in
pmemory are mapped to the device for DMA.

As of today, during kdump, during early device discovery, pci_dma_find()
finds that the device has 2 DMA windows. It selects to use DDW. This is a
kdump path and DMA window is needed for IO to the device.

Although commit 09a3c1e46142 ("powerpc/pseries/iommu: IOMMU table is not
initialized for kdump over SR-IOV") fixed an issue during kdump with SR-IOV
case, but this also made the kdump prefer DDW over the default DMA window
when both are present (dedicated adapter case). Since the DDW is fully
mapped by the previous kernel, iommu_table_clear() can free only
KDUMP_MIN_TCE_ENTRIES (2048) TCEs for use by kdump kernel.

This is not enough when the dump device is NVMe over Fibre Channel.
Because nvme-fc driver DMA-maps the cmds and resp IUs of every
pre-allocated request and each such mapping consumes roughly:

    32 (IO queues, one per cpus = nr_cpus) *
    64 (queue_depth, blk-mq kdump limit) *
    2 (cmd+resp) = 4096

This is already double of what we have without counting admin queues and
lpfc driver's own allocations / mapping requirement. Hence this results
into iommu_alloc failures like -

lpfc 0153:70:00.0: iommu_alloc failed,
tbl 0000000034ebcf5e vaddr 00000000d814df0b npages 1
lpfc 0153:70:00.0: FCP Op failed - cmdiu dma mapping failed.
lpfc 0153:70:00.0: iommu_alloc failed,
tbl 0000000034ebcf5e vaddr 000000009779e4d2 npages 1
lpfc 0153:70:00.0: FCP Op failed - cmdiu dma mapping failed.

iommu_map_phys+0x1c4/0x1f0 (unreliable)
dma_iommu_map_phys+0x54/0xa0
dma_map_phys+0x3f8/0x590
__nvme_fc_init_request+0x110/0x300 [nvme_fc]
nvme_fc_init_request+0x60/0xb8 [nvme_fc]
blk_mq_alloc_map_and_rqs+0x388/0x510
blk_mq_alloc_tag_set+0x2a4/0x5f0
nvme_alloc_io_tag_set+0xe0/0x1e0 [nvme_core]
nvme_fc_connect_ctrl_work+0x85c/0xdac [nvme_fc]
process_one_work+0x1e4/0x5a0
worker_thread+0x1ec/0x3e0

Increasing the number of free TCE entries in iommu_table_clear() will
increase the probability of hitting EEH since there could still be some
active IOs from the previous life of the kernel.

Hence this patch partially reverts the previous fixes commit and
switches the kdump's default back to 2GB default DMA window instead of
DDW window. This window will mostly be empty. Or, could be slightly used
if buffers in pmemory were mapped for IO.

Fixes: 09a3c1e46142 ("powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV")
Cc: stable@vger.kernel.org
Signed-off-by: Gaurav Batra 
Reviewed-by: Ritesh Harjani (IBM) 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260803224029.60538-1-gbatra@linux.ibm.com

powerpc/pseries: lparcfg - fix kbuf[] underflow

2026-08-08T05:04:28+00:00

In lparcfg_write(), a count of 0 results in kbuf[] being indexed at -1.
Check for count == 0 in the existing check for count > sizeof(kbuf) and
return -EINVAL if true.

Fixes: 74422e2b1939 ("powerpc/pseries: Remove VLA from lparcfg_write()")
Acked-by: Nayna Jain 
Tested-by: R Nageswara Sastry 
Cc: stable@vger.kernel.org # 4.20
Signed-off-by: George Wilson 
Signed-off-by: Madhavan Srinivasan

powerpc/pseries: pci - logic bug

2026-08-08T05:03:42+00:00

The checks on num_vfs in pseries_pci_sriov_enable() are ANDed where OR
was apparently intended.  Change it to OR.

Fixes: 9a7f6b438664 ("powerpc/pseries/pci: Associate PEs to VFs in configure SR-IOV")
Acked-by: Nayna Jain 
Tested-by: R Nageswara Sastry 
Cc: stable@vger.kernel.org # 4.16
Signed-off-by: George Wilson 
Signed-off-by: Madhavan Srinivasan

powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak

2026-08-08T05:02:26+00:00

In papr_phy_attest_create_handle(), the params->cmd.length is not
validated before use, which can result in a buffer overlow.  Check it and
return -EINVAL if it is either 0 or exceeds sizeof(params->cmd).

Also, params is freed on the success path but not error. Free it on
errors after memory allocation.  And free it on negative fd.

Fixes: 86900ab620a4 ("powerpc/pseries: Add a char driver for physical-attestation RTAS")
Acked-by: Haren Myneni 
Acked-by: Nayna Jain 
Tested-by: R Nageswara Sastry 
Cc: stable@vger.kernel.org # 6.16
Signed-off-by: George Wilson 
Signed-off-by: Madhavan Srinivasan

powerpc/crash: stop watchdogs before booting kdump kernel

2026-08-03T08:35:55+00:00

On pseries LPAR systems, watchdog timers configured from userspace can
remain active after a kernel panic. When a panic triggers kdump, the
crashing kernel jumps directly to the kdump kernel without stopping
active watchdogs. As a result, the watchdogs remain active after the
kdump kernel starts.

If dump capture takes longer than the watchdog timeout, PHYP resets the
LPAR before the dump is fully captured, causing dump capture to fail.

Fix this by issuing the `H_WATCHDOG` hcall during the crash shutdown
sequence to stop all active watchdogs before booting the kdump kernel.

Cc: stable@vger.kernel.org
Fixes: 69472ffa6575 ("watchdog/pseries-wdt: initial support for H_WATCHDOG-based watchdog timers")
Reported-by: Mahesh Kumar G 
Suggested-by: Ritesh Harjani (IBM) 
Reviewed-by: Ritesh Harjani (IBM) 
Signed-off-by: Sourabh Jain 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260727053416.276317-4-sourabhjain@linux.ibm.com

powerpc/pseries: Handle and log pseries-wdt registration failures

2026-08-03T08:35:55+00:00

The pseries watchdog initialization registers the pseries-wdt platform
device using platform_device_register_simple(), but currently ignores
its return value.

Check the returned pointer for errors, log a descriptive error message
when registration fails, and propagate the failure code to the caller.
This avoids silently ignoring platform device registration failures.

Cc: stable@vger.kernel.org
Reviewed-by: Ritesh Harjani (IBM) 
Signed-off-by: Sourabh Jain 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260727053416.276317-3-sourabhjain@linux.ibm.com

powerpc/xive: propagate IPI init errors to prevent use-after-free

2026-08-03T08:25:59+00:00

When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails),
the error path frees the global xive_ipis array.  However,
xive_smp_probe() previously ignored this failure and proceeded to
call xive_setup_cpu_ipi(), which dereferences the already-freed
xive_ipis pointer -- a use-after-free.

Now that xive_smp_probe() returns int (previous patch), propagate
the error from xive_init_ipis() and xive_setup_cpu_ipi() through
xive_smp_probe().  Check the return value in both pnv_smp_probe()
and pSeries_smp_probe() so that IPI setup is aborted cleanly on
failure, avoiding the use-after-free.

Fixes: 243e25112d06 ("powerpc/xive: Native exploitation of the XIVE interrupt controller")
Fixes: cbc06f051c52 ("powerpc/xive: Do not skip CPU-less nodes when creating the IPIs")
Signed-off-by: Gou Hao 
Reviewed-by: Wentao Guan 
Reviewed-by: jiazhenyuan 
Reviewed-by: Cédric Le Goater 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260727104215.184786-4-gouhao@uniontech.com

powerpc/pseries: Avoid strlen() in do_{remove,update}_property()

2026-07-31T11:36:44+00:00

Check only the first byte instead of scanning the entire string with
strlen().

Signed-off-by: Thorsten Blum 
Reviewed-by: Christophe Leroy (CS GROUP) 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260721155346.121975-4-thorsten.blum@linux.dev