summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2026-02-02mailbox: Remove mailbox_client.h from controller driversPeng Fan3-3/+0
mailbox_client.h should be used by mailbox consumer drivers, not mailbox controller (provider) drivers. The affected drivers do not use any mailbox client APIs, so the include can be safely removed. Signed-off-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-25mailbox: zynqmp-ipi: Simplify with scoped for each OF child loopKrzysztof Kozlowski1-3/+2
Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-25mailbox: mtk-cmdq: Simplify with scoped for each OF child loopKrzysztof Kozlowski1-8/+4
Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-25dt-bindings: mailbox: xlnx,zynqmp-ipi-mailbox: Document msg region requirementHarini T1-0/+11
Add description clarifying that for Versal IPI mailboxes, both host and remote agents must have the "msg" register region defined for successful message passing. Without both, only notification-based communication works. Signed-off-by: Harini T <harini.t@amd.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-25mailbox: Improve RISCV_SBI_MPXY_MBOX guidanceGeert Uytterhoeven1-2/+2
RISC-V SBI Message Proxy (MPXY) Mailbox support defaults to enabled, but the help text states "If unsure say N". Recommend enabling this driver, as it is a very critical RISC-V driver providing mailbox channels to other drivers such as clock, system MSIs, etc. Fixes: bf3022a4eb119c6b ("mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver") Suggested-by: Anup Patel <anup@brainfault.org> Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Anup Patel <anup@brainfault.org> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-25mailbox: mchp-ipc-sbi: fix uninitialized symbol and other smatch warningsValentina Fernandez1-12/+9
Fix uninitialized symbol 'hartid' warning in mchp_ipc_cluster_aggr_isr() by introducing a 'found' flag to track whether the IRQ matches any online hart. If no match is found, return IRQ_NONE. Also fix other smatch warnings by removing dead code in mchp_ipc_startup() and by returning -ENODEV in dev_err_probe() if the Microchip SBI extension is not found. Fixes below smatch warnings: drivers/mailbox/mailbox-mchp-ipc-sbi.c:187 mchp_ipc_cluster_aggr_isr() error: uninitialized symbol 'hartid'. drivers/mailbox/mailbox-mchp-ipc-sbi.c:324 mchp_ipc_startup() warn: ignoring unreachable code. drivers/mailbox/mailbox-mchp-ipc-sbi.c:422 mchp_ipc_probe() warn: passing zero to 'dev_err_probe' Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/r/202512171533.CDLdScMY-lkp@intel.com/ Signed-off-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-25mailbox: arm_mhuv3: fix typo in commentLakshmi S1-1/+1
Fix typo "channnels"-> "channels" in struct documentation. Signed-off-by: Lakshmi S <lakshmicar.2023@gmail.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-25mailbox: cix: fix typo in error messageLakshmi S1-1/+1
Fix typo "overlow" -> "overflow" in FIFO overflow error message. Signed-off-by: Lakshmi S <lakshmicar.2023@gmail.com> Reviewed-by: Peter Chen <peter.chen@cixtech.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-25mailbox: imx: Skip the suspend flag for i.MX7ULPJacky Bai1-2/+6
In current imx-mailbox driver, the MU IRQ is configured with 'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow, the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx: fix wakeup failure from freeze mode"), if the MU IRQ is triggered after the priv->suspended flag has been set, the system suspend will be aborted. On i.MX7ULP platform, certain drivers that depend on rpmsg may need to send rpmsg request and receive an acknowledgment from the remote core during the late_suspend stage. Early suspend abort is not expected, and the i.MX7ULP already has additional hardware and software to make sure the system can be wakeup from freeze mode correctly when MU IRQ is trigger. Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the early abort when doing suspend. Signed-off-by: Jacky Bai <ping.bai@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-25mailbox: exynos: drop unneeded runtime pointer (pclk)André Draszik1-5/+4
pclk is not needed past probe(), just drop it. This saves a little bit of runtime memory. Signed-off-by: André Draszik <andre.draszik@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-25mailbox: pcc: Remove spurious IRQF_ONESHOT usageMark Brown1-1/+1
The PCC code currently specifies IRQF_ONESHOT if the interrupt could potentially be shared but doesn't actually use request_threaded_irq() and the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is never relevant. Since commit aef30c8d569c ("genirq: Warn about using IRQF_ONESHOT without a threaded handler") specifying it has resulted in a WARN_ON(), fix this by removing IRQF_ONESHOT. Reported-by: Aishwarya TCV <Aishwarya.TCV@arm.com> Signed-off-by: Mark Brown <broonie@kernel.org> Reviewed-by: Sudeep Holla <sudeep.holla@arm.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: mtk-cmdq: Add driver data to support for MT8196Jason-JH Lin1-0/+12
MT8196 has 2 new hardware configuration compared with the previous SoC, which correspond to the 2 new driver data: 1. mminfra_offset: For GCE data path control Since GCE has been moved into mminfra, GCE needs to append the mminfra offset to the DRAM address when accessing the DRAM. 2. gce_vm: For GCE hardware virtualization control Currently, the first version of the mt8196 mailbox controller only requires setting the VM-related registers to enable the permissions of a host VM. Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com> Reviewed-by: CK Hu <ck.hu@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: mtk-cmdq: Add mminfra_offset configuration for DRAM transactionJason-JH Lin2-2/+5
The GCE in MT8196 is placed in MMINFRA and requires all addresses in GCE instructions for DRAM transactions to be IOVA. Due to MMIO, if the GCE needs to access a hardware register at 0x1000_0000, but the SMMU is also mapping a DRAM block at 0x1000_0000, the MMINFRA will not know whether to write to the hardware register or the DRAM. To solve this, MMINFRA treats addresses greater than 2G as data paths and those less than 2G as config paths because the DRAM start address is currently at 2G (0x8000_0000). On the data path, MMINFRA remaps DRAM addresses by subtracting 2G, allowing SMMU to map DRAM addresses less than 2G. For example, if the DRAM start address 0x8000_0000 is mapped to IOVA=0x0, when GCE accesses IOVA=0x0, it must add a 2G offset to the address in the GCE instruction. MMINFRA will then see it as a data path (IOVA >= 2G) and subtract 2G, allowing GCE to access IOVA=0x0. Since the MMINFRA remap subtracting 2G is done in hardware and cannot be configured by software, the address of DRAM in GCE instruction must always add 2G to ensure proper access. After that, the shift functions do more than just shift addresses, so the APIs were renamed to cmdq_convert_gce_addr() and cmdq_revert_gce_addr(). This 2G adjustment is referred to as mminfra_offset in the CMDQ driver. CMDQ helper can get the mminfra_offset from the cmdq_mbox_priv of cmdq_pkt and add the mminfra_offset to the DRAM address in GCE instructions. Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: mtk-cmdq: Add GCE hardware virtualization configurationJason-JH Lin1-0/+48
The GCE hardware virtualization configuration supports the isolation of GCE hardware resources across different OS environments. Each OS is treated as a virtual machine (VM) for GCE purposes. There are 6 VMs and 1 host VM. The host VM has main control over the GCE virtualization settings for all VMs. To properly access the GCE thread registers, it is necessary to configure access permissions for specific GCE threads assigned to different VMs. Currently, since only the host VM is being used, it is required to enable access permissions for all GCE threads for the host VM. There are 2 VM configurations: 1. VM_ID_MAP There are 4 registers to allocate 32 GCE threads across different VMs: VM_ID_MAP0 for threads 0-9, VM_ID_MAP1 for threads 10-19, VM_ID_MAP2 for threads 20-29, and VM_ID_MAP3 for threads 30-31. Each thread has a 3-bit configuration, where setting all bits to 1 configures the thread for the host VM. 2. VM_CPR_GSIZE It is used to allocate the CPR SRAM size to each VM. Each VM has 4-bit configuration, where setting bit 0-3 to configures the size of host VM. This setting must be configured before the VM configuration to prevent resource leakage. Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: mtk-cmdq: Add cmdq private data to cmdq_pkt for generating instructionJason-JH Lin2-0/+26
Add the cmdq_mbox_priv structure to store the private data of GCE, such as the shift bits of the physical address. Then, include the cmdq_mbox_priv structure within the cmdq_pkt structure. This allows CMDQ users to utilize the private data in cmdq_pkt to generate GCE instructions when needed. Additionally, having cmdq_mbox_priv makes it easier to expand and reference other GCE private data in the future. Add cmdq_get_mbox_priv() for CMDQ users to get all the private data into the cmdq_mbox_priv of the cmdq_pkt. Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: pcc: Clear any pending responder interrupts before enabling itSudeep Holla1-0/+6
Some platforms may leave a responder interrupt pending from earlier transactions. If a PCC responder channel has a pending interrupt when the controller starts up, enabling the IRQ line without first clearing the condition can lead to a spurious interrupt which could disrupt other transmissions if the IRQ is shared. Explicitly clear any pending responder interrupt before enabling the IRQ to ensure a clean start. Acknowledge the responder channel via pcc_chan_acknowledge() in startup before requesting/enablement of the IRQ. This ensures a clean baseline for the first transfer/receiption of the notification/response. Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Tested-by: Adam Young <admiyo@os.amperecomputing.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: pcc: Initialize SHMEM before binding the channel with the clientSudeep Holla1-8/+10
The PCC channel's shared memory region must be set up before the mailbox controller binds the channel with the client, as the binding process may trigger client operations like startup() that may rely on SHMEM being initialized. Reorder the setup sequence to ensure the shared memory is ready before binding. Initialize and map the PCC shared memory (SHMEM) prior to calling mbox_bind_client() so that clients never observe an uninitialized or NULL SHMEM during bind-time callbacks or early use in startup(). This makes the PCC mailbox channel bring-up order consistent and eliminates a race between SHMEM setup and client binding. This will be needed in channel startup to clear/acknowledge any pending interrupts before enabling them. Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Acked-by: lihuisong@huawei.com Tested-by: Adam Young <admiyo@os.amperecomputing.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: pcc: Mark Tx as complete in PCC IRQ handlerSudeep Holla1-0/+1
The PCC IRQ handler clears channel-in-use and notifies clients with mbox_chan_received_data(), but it does not explicitly mark the transmit as complete. In IRQ completion mode this could leave Tx complete waiters hanging or lead to generic timeouts in the mailbox core. Invoke mbox_chan_txdone() in the IRQ path once the platform has acknowledged the transfer so the core can wake any waiters and update state accordingly. Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Tested-by: Adam Young <admiyo@os.amperecomputing.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: pcc: Set txdone_irq/txdone_poll based on PCCT flagsSudeep Holla1-1/+6
The PCC controller currently enables txdone via IRQ if the PCCT exposes platform capability to generate command completion interrupt, but it leaves txdone_poll unchanged. Make the behaviour explicit: - If ACPI_PCCT_DOORBELL is present, use txdone_irq and disable polling. - Otherwise, disable txdone_irq and fall back to txdone_poll. Configure the PCC mailbox to use interrupt-based completion for PCC types that signal completion via IRQ using TXDONE_BY_IRQ, and fall back to polling for others using TXDONE_BY_POLL. This ensures the PCC driver uses the appropriate completion mechanism according to the PCCT table definition and makes the completion mode unambiguous avoiding mixed signalling when the platform lacks a doorbell flag set. Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Tested-by: Adam Young <admiyo@os.amperecomputing.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: pcc: Wire up ->last_tx_done() for PCC channelsSudeep Holla1-0/+8
Some PCC users poll for completion between transfers and benefit from the knowledge of previous Tx completion check through the mailbox framework's ->last_tx_done() op. Hook up the last_tx_done callback in the PCC mailbox driver so the mailbox framework can correctly query the completion status of the last transmitted message. This aligns PCC with other controllers that already implement such last_tx_done status query. No functional change unless callers use ->last_tx_done(). Normal Tx and IRQ paths are unchanged. This change just improves synchronization and avoids unnecessary timeouts for non-interrupt driven channels by ensuring correct completion detection for PCC channels that don’t rely on interrupts. Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Tested-by: Adam Young <admiyo@os.amperecomputing.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18Revert "mailbox/pcc: support mailbox management of the shared buffer"Sudeep Holla2-127/+4
This reverts commit 5378bdf6a611a32500fccf13d14156f219bb0c85. Commit 5378bdf6a611 ("mailbox/pcc: support mailbox management of the shared buffer") attempted to introduce generic helpers for managing the PCC shared memory, but it largely duplicates functionality already provided by the mailbox core and leaves gaps: 1. TX preparation: The mailbox framework already supports this via ->tx_prepare callback for mailbox clients. The patch adds pcc_write_to_buffer() and expects clients to toggle pchan->chan.manage_writes, but no drivers set manage_writes, so pcc_write_to_buffer() has no users. 2. RX handling: Data reception is already delivered through mbox_chan_received_data() and client ->rx_callback. The patch adds an optional pchan->chan.rx_alloc, which again has no users and duplicates the existing path. 3. Completion handling: While adding last_tx_done is directionally useful, the implementation only covers Type 3/4 and fails to handle the absence of a command_complete register, so it is incomplete for other types. Given the duplication and incomplete coverage, revert this change. Any new requirements should be addressed in focused follow-ups rather than bundling multiple behavioral changes together. Fixes: 5378bdf6a611 ("mailbox/pcc: support mailbox management of the shared buffer") Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: mpfs: drop POLARFIRE from ARCH_MICROCHIP_POLARFIREConor Dooley1-1/+1
The ARCH_MICROCHIP symbol has been defined for some time on RISCV, as a replacement for ARCH_MICROCHIP_POLARFIRE since there are now other Microchip RISC-V products. Drop the POLARFIRE from ARCH_MICROCHIP_POLARFIRE in the POLARFIRE_SOC_MAILBOX Kconfig entry since the newly added pic64gx also uses the mailbox and it is one of the few users of ARCH_MICROCHIP_POLARFIRE left in the tree. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18dt-bindings: mbox: add pic64gx mailbox compatibility to mpfs mailboxPierre-Henry Moussay1-1/+5
pic64gx mailbox is compatible with mpfs mailbox, even if the mailbox consumer is not - the underlying communication mechanism is the same. Signed-off-by: Pierre-Henry Moussay <pierre-henry.moussay@microchip.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: mchp-ipc-sbi: fix out-of-bounds access in ↵Valentina Fernandez1-11/+11
mchp_ipc_get_cluster_aggr_irq() The cluster_cfg array is dynamically allocated to hold per-CPU configuration structures, with its size based on the number of online CPUs. Previously, this array was indexed using hartid, which may be non-contiguous or exceed the bounds of the array, leading to out-of-bounds access. Switch to using cpuid as the index, as it is guaranteed to be within the valid range provided by for_each_online_cpu(). Signed-off-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com> Reviewed-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18dt-bindings: mailbox: qcom: Add CPUCP mailbox controller bindings for KaanapaliJingyi Wang1-0/+1
Document CPUSS Control Processor (CPUCP) mailbox controller for Qualcomm Kaanapali, which is compatible with X1E80100, use fallback to indicate this. Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: remove unneeded double quotationKuninori Morimoto1-1/+1
It makes Kconfig strange. fix it. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()Joonwon Kang1-4/+2
Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function. Cc: stable@vger.kernel.org Signed-off-by: Joonwon Kang <joonwonkang@google.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18mailbox: mediatek: Add mtk-vcp-mailbox driverJjian Zhou4-0/+213
Add mtk-vcp-mailbox driver to support the communication with VCP remote microprocessor. Signed-off-by: Jjian Zhou <jjian.zhou@mediatek.com> Reviewed-by: Chen-Yu Tsai <wenst@chromium.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18dt-bindings: mailbox: mediatek,mt8196-vcp-mbox: add mtk vcp-mbox documentJjian Zhou1-0/+49
The MTK VCP mailbox enables the SoC to communicate with the VCP by passing messages through 64 32-bit wide registers. It has 32 interrupt vectors in either direction for signalling purposes. This adds a binding for Mediatek VCP mailbox. Signed-off-by: Jjian Zhou <jjian.zhou@mediatek.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Reviewed-by: Chen-Yu Tsai <wenst@chromium.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-01-18Merge tag 'for-6.19-rc5-tag' of ↵Linus Torvalds8-68/+41
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - with large folios in use, fix partial incorrect update of a reflinked range - fix potential deadlock in iget when lookup fails and eviction is needed - in send, validate inline extent type while detecting file holes - fix memory leak after an error when creating a space info - remove zone statistics from sysfs again, the output size limitations make it unusable, we'll do it in another way in another release - test fixes: - return proper error codes from block remapping tests - fix tree root leaks in qgroup tests after errors * tag 'for-6.19-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: remove zoned statistics from sysfs btrfs: fix memory leaks in create_space_info() error paths btrfs: invalidate pages instead of truncate after reflinking btrfs: update the Kconfig string for CONFIG_BTRFS_EXPERIMENTAL btrfs: send: check for inline extents in range_is_hole_in_parent() btrfs: tests: fix return 0 on rmap test failure btrfs: tests: fix root tree leak in btrfs_test_qgroups() btrfs: release path before iget_failed() in btrfs_read_locked_inode()
2026-01-18Merge tag 'loongarch-fixes-6.19-2' of ↵Linus Torvalds8-49/+52
git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Remove redundant code in head.S, fix PMU counter allocation for mixed- type event groups, fix a lot of dts build warnings, and fix kvm_device memory leaks" * tag 'loongarch-fixes-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy() LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy() LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy() LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells LoongArch: dts: Describe PCI sideband IRQ through interrupt-extended LoongArch: Fix PMU counter allocation for mixed-type event groups LoongArch: Remove redundant code in head.S
2026-01-17Merge tag 'arm64-fixes' of ↵Linus Torvalds1-3/+6
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: "An arm64/mpam fix to use non-atomic bitops on struct mmap_props member (atomicity not required). For kunit testing, the structure is packed to avoid memcmp() errors but this affects atomic bitops as they have strict alignment requirements. Also remove a duplicate include in the mpam driver" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm_mpam: Use non-atomic bitops when modifying feature bitmap arm_mpam: Remove duplicate linux/srcu.h header
2026-01-17Merge tag 'block-6.19-20260116' of ↵Linus Torvalds8-10/+38
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith: - Device quirk to disable faulty temperature (Ilikara) - TCP target null pointer fix from bad host protocol usage (Shivam) - Add apple,t8103-nvme-ans2 as a compatible apple controller (Janne) - FC tagset leak fix (Chaitanya) - TCP socket deadlock fix (Hannes) - Target name buffer overrun fix (Shin'ichiro) - Fix for an underflow for rnbd during device unmap - Zero the non-PI part of the auto integrity buffer - Fix for a configfs memory leak in the null block driver * tag 'block-6.19-20260116' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: rnbd-clt: fix refcount underflow in device unmap path nvme: fix PCIe subsystem reset controller state transition nvmet: do not copy beyond sybsysnqn string length nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() null_blk: fix kmemleak by releasing references to fault configfs items block: zero non-PI portion of auto integrity buffer nvme-fc: release admin tagset if init fails nvme-apple: add "apple,t8103-nvme-ans2" as compatible nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec nvme-pci: disable secondary temp for Wodposit WPBSNM8
2026-01-17Merge tag 'io_uring-6.19-20260116' of ↵Linus Torvalds1-4/+4
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "Just a single fix moving local task_work inside the cancelation loop, rather than only before cancelations. If any cancelations generate task_work, we do need to re-run it" * tag 'io_uring-6.19-20260116' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: move local task_work in exit cancel loop
2026-01-17LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy()Qiang Ma1-0/+1
In kvm_ioctl_create_device(), kvm_device has allocated memory, kvm_device->destroy() seems to be supposed to free its kvm_device struct, but kvm_pch_pic_destroy() is not currently doing this, that would lead to a memory leak. So, fix it. Cc: stable@vger.kernel.org Reviewed-by: Bibo Mao <maobibo@loongson.cn> Signed-off-by: Qiang Ma <maqianga@uniontech.com> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-01-17LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy()Qiang Ma1-0/+1
In kvm_ioctl_create_device(), kvm_device has allocated memory, kvm_device->destroy() seems to be supposed to free its kvm_device struct, but kvm_eiointc_destroy() is not currently doing this, that would lead to a memory leak. So, fix it. Cc: stable@vger.kernel.org Reviewed-by: Bibo Mao <maobibo@loongson.cn> Signed-off-by: Qiang Ma <maqianga@uniontech.com> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-01-17LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy()Qiang Ma1-0/+1
In kvm_ioctl_create_device(), kvm_device has allocated memory, kvm_device->destroy() seems to be supposed to free its kvm_device struct, but kvm_ipi_destroy() is not currently doing this, that would lead to a memory leak. So, fix it. Cc: stable@vger.kernel.org Reviewed-by: Bibo Mao <maobibo@loongson.cn> Signed-off-by: Qiang Ma <maqianga@uniontech.com> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-01-17LoongArch: dts: loongson-2k1000: Fix i2c-gpio node namesBinbin Zhou1-2/+2
The binding wants the node to be named "i2c-number", but those are named "i2c-gpio-number" instead. Thus rename those to i2c-0, i2c-1 to adhere to the binding and suppress dtbs_check warnings. Cc: stable@vger.kernel.org Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-01-17LoongArch: dts: loongson-2k2000: Add default interrupt controller address cellsBinbin Zhou1-0/+3
Add missing address-cells 0 to the Local I/O, Extend I/O and PCH-PIC Interrupt Controller node to silence W=1 warning: loongson-2k2000.dtsi:364.5-49: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@9,0:interrupt-map: Missing property '#address-cells' in node /bus@10000000/interrupt-controller@10000000, using 0 as fallback Value '0' is correct because: 1. The LIO/EIO/PCH interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Cc: stable@vger.kernel.org Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-01-17LoongArch: dts: loongson-2k1000: Add default interrupt controller address cellsBinbin Zhou1-0/+2
Add missing address-cells 0 to the Local I/O interrupt controller node to silence W=1 warning: loongson-2k1000.dtsi:498.5-55: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@9,0:interrupt-map: Missing property '#address-cells' in node /bus@10000000/interrupt-controller@1fe01440, using 0 as fallback Value '0' is correct because: 1. The Local I/O interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Cc: stable@vger.kernel.org Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-01-17LoongArch: dts: loongson-2k0500: Add default interrupt controller address cellsBinbin Zhou1-0/+3
Add missing address-cells 0 to the Local I/O and Extend I/O interrupt controller node to silence W=1 warning: loongson-2k0500.dtsi:513.5-51: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@0,0:interrupt-map: Missing property '#address-cells' in node /bus@10000000/interrupt-controller@1fe11600, using 0 as fallback Value '0' is correct because: 1. The Local I/O & Extend I/O interrupt controller do not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Cc: stable@vger.kernel.org Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-01-17LoongArch: dts: Describe PCI sideband IRQ through interrupt-extendedYao Zi2-36/+21
SoC integrated peripherals on LS2K1000 and LS2K2000 could be discovered as PCI devices, but require sideband interrupts to function, which are previously described by interrupts and interrupt-parent properties. However, pci/pci-device.yaml allows interrupts property to only specify PCI INTx interrupts, not sideband ones. Convert these devices to use interrupt-extended property, which describes sideband interrupts used by PCI devices since dt-schema commit e6ea659d2baa ("schemas: pci-device: Allow interrupts-extended for sideband interrupts"), eliminating dtbs_check warnings. Cc: stable@vger.kernel.org Fixes: 30a5532a3206 ("LoongArch: dts: DeviceTree for Loongson-2K1000") Signed-off-by: Yao Zi <me@ziyao.cc> Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-01-17LoongArch: Fix PMU counter allocation for mixed-type event groupsLisa Robinson1-3/+18
When validating a perf event group, validate_group() unconditionally attempts to allocate hardware PMU counters for the leader, sibling events and the new event being added. This is incorrect for mixed-type groups. If a PERF_TYPE_SOFTWARE event is part of the group, the current code still tries to allocate a hardware PMU counter for it, which can wrongly consume hardware PMU resources and cause spurious allocation failures. Fix this by only allocating PMU counters for hardware events during group validation, and skipping software events. A trimmed down reproducer is as simple as this: #include <stdio.h> #include <assert.h> #include <unistd.h> #include <string.h> #include <sys/syscall.h> #include <linux/perf_event.h> int main (int argc, char *argv[]) { struct perf_event_attr attr = { 0 }; int fds[5]; attr.disabled = 1; attr.exclude_kernel = 1; attr.exclude_hv = 1; attr.read_format = PERF_FORMAT_TOTAL_TIME_ENABLED | PERF_FORMAT_TOTAL_TIME_RUNNING | PERF_FORMAT_ID | PERF_FORMAT_GROUP; attr.size = sizeof (attr); attr.type = PERF_TYPE_SOFTWARE; attr.config = PERF_COUNT_SW_DUMMY; fds[0] = syscall (SYS_perf_event_open, &attr, 0, -1, -1, 0); assert (fds[0] >= 0); attr.type = PERF_TYPE_HARDWARE; attr.config = PERF_COUNT_HW_CPU_CYCLES; fds[1] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0); assert (fds[1] >= 0); attr.type = PERF_TYPE_HARDWARE; attr.config = PERF_COUNT_HW_INSTRUCTIONS; fds[2] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0); assert (fds[2] >= 0); attr.type = PERF_TYPE_HARDWARE; attr.config = PERF_COUNT_HW_BRANCH_MISSES; fds[3] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0); assert (fds[3] >= 0); attr.type = PERF_TYPE_HARDWARE; attr.config = PERF_COUNT_HW_CACHE_REFERENCES; fds[4] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0); assert (fds[4] >= 0); printf ("PASSED\n"); return 0; } Cc: stable@vger.kernel.org Fixes: b37042b2bb7c ("LoongArch: Add perf events support") Signed-off-by: Lisa Robinson <lisa@bytefly.space> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-01-17Merge tag 'drm-fixes-2026-01-16' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds35-200/+320
Pull drm fixes from Simona Vetter: "We've had nothing aside of a compiler noise fix until today, when the amd and drm-misc fixes showed up after Dave already went into weekend mode. So it's on me to push these out, since there's a bunch of important fixes in here I think that shouldn't be delayed for a week. Core Changes: - take gem lock when preallocating in gpuvm - add single byte read fallback to dp for broken usb-c adapters - remove duplicate drm_sysfb declarations Driver Changes: - i915: compiler noise fix - amdgpu/amdkfd: pile of fixes all over - vmwgfx: - v10 cursor regression fix - other fixes - rockchip: - waiting for cfgdone regression fix - other fixes - gud: fix oops on disconnect - simple-panel: - regression fix when connector is not set - fix for DataImage SCF0700C48GGU18 - nouveau: cursor handling locking fix" * tag 'drm-fixes-2026-01-16' of https://gitlab.freedesktop.org/drm/kernel: (33 commits) drm/amd/display: Add an hdmi_hpd_debounce_delay_ms module drm/amdgpu/userq: Fix fence reference leak on queue teardown v2 drm/amdkfd: No need to suspend whole MES to evict process Revert "drm/amdgpu: don't attach the tlb fence for SI" drm/amdgpu: validate the flush_gpu_tlb_pasid() drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 drm/amd/display: Initialise backlight level values from hw drm/amd/display: Bump the HDMI clock to 340MHz drm/amd/display: Show link name in PSR status message drm/amdkfd: fix a memory leak in device_queue_manager_init() drm/amdgpu: make sure userqs are enabled in userq IOCTLs drm/amdgpu: Use correct address to setup gart page table for vram access Revert duplicate "drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces" drm/amd: Clean up kfd node on surprise disconnect drm/amdgpu: fix drm panic null pointer when driver not support atomic drm/amdgpu: Fix gfx9 update PTE mtype flag drm/sysfb: Remove duplicate declarations drm/nouveau/kms/nv50-: Assert we hold nv50_disp->lock in nv50_head_flush_* drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare drm/gud: fix NULL fb and crtc dereferences on USB disconnect ...
2026-01-17Merge tag 'cxl-fixes-6.19-rc6' of ↵Linus Torvalds8-41/+70
git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull Compute Express Link (CXL) fixes from Dave Jiang: - Recognize all ZONE_DEVICE users as physaddr consumers - Fix format string for extended_linear_cache_size_show() - Fix target list setup for multiple decoders sharing the same downstream port - Restore HBIW check before derefernce platform data - Fix potential infinite loop in __cxl_dpa_reserve() - Check for invalid addresses returned from translation functions on error * tag 'cxl-fixes-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl: Check for invalid addresses returned from translation functions on errors cxl/hdm: Fix potential infinite loop in __cxl_dpa_reserve() cxl/acpi: Restore HBIW check before dereferencing platform_data cxl/port: Fix target list setup for multiple decoders sharing the same dport cxl/region: fix format string for resource_size_t x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
2026-01-16Merge tag 'pci-v6.19-fixes-3' of ↵Linus Torvalds1-0/+4
git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fix from Bjorn Helgaas: - Add a pci_free_irq_vectors() stub to fix a build issue when CONFIG_PCI is not set (Boqun Feng) * tag 'pci-v6.19-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: Provide pci_free_irq_vectors() stub
2026-01-16Merge tag 'pm-6.19-rc6' of ↵Linus Torvalds10-288/+454
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix an error path memory leak in the energy model management code, fix a kerneldoc comment in it, and fix and revamp the energy model YNL specification added recently along with the new energy model management netlink interface (that received feedback after being added): - Fix a memory leak in em_create_pd() error path (Malaya Kumar Rout) - Fix stale description of the cost field in struct em_perf_state to reflect the current code (Yaxiong Tian) - Fix and revamp the energy model YNL specification added recently along with the energy model netlink interface (Changwoo Min)" * tag 'pm-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: EM: Add dump to get-perf-domains in the EM YNL spec PM: EM: Change cpus' type from string to u64 array in the EM YNL spec PM: EM: Rename em.yaml to dev-energymodel.yaml PM: EM: Fix yamllint warnings in the EM YNL spec PM: EM: Fix memory leak in em_create_pd() error path PM: EM: Fix incorrect description of the cost field in struct em_perf_state
2026-01-16Merge tag 'drm-misc-fixes-2026-01-16' of ↵Simona Vetter16-149/+203
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.19-rc6: vmwgfx: - Fix hw regression from refactoring cursor handling on v10 'hardware' - Fix warnings in destructor by merging the 2 release functions - kernel doc fix - error handling in vmw_compat_shader_add() rockchip: - fix vop2 polling - fix regression waiting for cfgdone without config change - fix warning when enabling encoder core: - take gem lock when preallocating in gpuvm. - add single byte read fallback to dp for broken usb-c adapters - remove duplicate drm_sysfb declarations gud: - Fix oops on usb disconnect Simple panel: - Re-add fallback when connector is not set to fix regressions - Set correct type in DataImage SCF0700C48GGU18 nouveau: - locking fixes for cursor handling. Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/ce0acfe2-9c1a-42b7-8782-f1e7f34b8544@linux.intel.com
2026-01-16Merge tag 'acpi-6.19-rc6' of ↵Linus Torvalds1-2/+7
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "Add checks missed by a previous recent update to the ACPI suspend-to-idle code and add a debug module parameter to it to work around a platform firmware issue exposed by that update (Rafael Wysocki)" * tag 'acpi-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PM: s2idle: Add module parameter for LPS0 constraints checking ACPI: PM: s2idle: Add missing checks to acpi_s2idle_begin_lps0()
2026-01-16Merge tag 'sound-6.19-rc6' of ↵Linus Torvalds23-41/+182
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This became a bit larger than wished for, often seen as a bump at the middle, but almost all changes are small device-specific fixes, so the risk must be pretty low. - SoundWire fix for missing symbol export - Fixes for device-tree bindings - A fix for OOB access in USB-audio, spotted by fuzzer - Quirks for HD-audio, SoundWire, AMD ACP - A series of ASoC tlv320 and wsa codec fixes - Other misc fixes in PCM OSS error-handling, Cirrus scodec test, ASoC ops endianess, davinci, simple-card, and tegra" * tag 'sound-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (33 commits) ALSA: hda/tas2781: Add newly-released HP laptop ASoC: rt5640: Fix duplicate clock properties in DT binding ALSA: hda/realtek: Add quirk for HP Pavilion x360 to enable mute LED ASoC: tlv320adcx140: fix word length ASoC: tlv320adcx140: Propagate error codes during probe ASoC: tlv320adcx140: fix null pointer ASoC: tlv320adcx140: invert DRE_ENABLE ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type ASoC: sdw_utils: Call init callbacks on the correct codec DAI soundwire: Add missing EXPORT for sdw_slave_type ALSA: usb-audio: Prevent excessive number of frames ALSA: hda/cirrus_scodec_test: Fix test suite name ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip ALSA: hda/realtek: Add quirk for Asus Zephyrus G14 2025 using CS35L56, fix speakers ASoC: amd: yc: Fix microphone on ASUS M6500RE ASoC: tegra: Revert fix for uninitialized flat cache warning in tegra210_ahub ASoC: dt-bindings: rockchip-spdif: Allow "port" node ASoC: dt-bindings: realtek,rt5640: Allow 7 for realtek,jack-detect-source ASoC: dt-bindings: realtek,rt5640: Add missing properties/node ASoC: dt-bindings: realtek,rt5640: Document port node ...