summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2025-09-18octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()Duoming Zhou1-1/+1
The original code relies on cancel_delayed_work() in otx2_ptp_destroy(), which does not ensure that the delayed work item synctstamp_work has fully completed if it was already running. This leads to use-after-free scenarios where otx2_ptp is deallocated by otx2_ptp_destroy(), while synctstamp_work remains active and attempts to dereference otx2_ptp in otx2_sync_tstamp(). Furthermore, the synctstamp_work is cyclic, the likelihood of triggering the bug is nonnegligible. A typical race condition is illustrated below: CPU 0 (cleanup) | CPU 1 (delayed work callback) otx2_remove() | otx2_ptp_destroy() | otx2_sync_tstamp() cancel_delayed_work() | kfree(ptp) | | ptp = container_of(...); //UAF | ptp-> //UAF This is confirmed by a KASAN report: BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff88800aa09a18 by task bash/136 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 run_timer_softirq+0xd1/0x190 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ> ... Allocated by task 1: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 otx2_ptp_init+0xb1/0x860 otx2_probe+0x4eb/0xc30 local_pci_probe+0xdc/0x190 pci_device_probe+0x2fe/0x470 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __driver_attach+0xd2/0x310 bus_for_each_dev+0xed/0x170 bus_add_driver+0x208/0x500 driver_register+0x132/0x460 do_one_initcall+0x89/0x300 kernel_init_freeable+0x40d/0x720 kernel_init+0x1a/0x150 ret_from_fork+0x10c/0x1a0 ret_from_fork_asm+0x1a/0x30 Freed by task 136: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 otx2_ptp_destroy+0x38/0x80 otx2_remove+0x10d/0x4c0 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0xf8/0x210 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device_locked+0x15/0x30 remove_store+0xcc/0xe0 kernfs_fop_write_iter+0x2c3/0x440 vfs_write+0x871/0xd70 ksys_write+0xee/0x1c0 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled before the otx2_ptp is deallocated. This bug was initially identified through static analysis. To reproduce and test it, I simulated the OcteonTX2 PCI device in QEMU and introduced artificial delays within the otx2_sync_tstamp() function to increase the likelihood of triggering the bug. Fixes: 2958d17a8984 ("octeontx2-pf: Add support for ptp 1-step mode on CN10K silicon") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-18cnic: Fix use-after-free bugs in cnic_delete_taskDuoming Zhou1-2/+1
The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(), which does not guarantee that the delayed work item 'delete_task' has fully completed if it was already running. Additionally, the delayed work item is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after the cyclic work items have finished executing, a delayed work item may still exist in the workqueue. This leads to use-after-free scenarios where the cnic_dev is deallocated by cnic_free_dev(), while delete_task remains active and attempt to dereference cnic_dev in cnic_delete_task(). A typical race condition is illustrated below: CPU 0 (cleanup) | CPU 1 (delayed work callback) cnic_netdev_event() | cnic_stop_hw() | cnic_delete_task() cnic_cm_stop_bnx2x_hw() | ... cancel_delayed_work() | /* the queue_delayed_work() flush_workqueue() | executes after flush_workqueue()*/ | queue_delayed_work() cnic_free_dev(dev)//free | cnic_delete_task() //new instance | dev = cp->dev; //use Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the cyclic delayed work item is properly canceled and that any ongoing execution of the work item completes before the cnic_dev is deallocated. Furthermore, since cancel_delayed_work_sync() uses __flush_work(work, true) to synchronously wait for any currently executing instance of the work item to finish, the flush_workqueue() becomes redundant and should be removed. This bug was identified through static analysis. To reproduce the issue and validate the fix, I simulated the cnic PCI device in QEMU and introduced intentional delays — such as inserting calls to ssleep() within the cnic_delete_task() function — to increase the likelihood of triggering the bug. Fixes: fdf24086f475 ("cnic: Defer iscsi connection cleanup") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-18net: liquidio: fix overflow in octeon_init_instr_queue()Alexey Nepomnyashih1-1/+1
The expression `(conf->instr_type == 64) << iq_no` can overflow because `iq_no` may be as high as 64 (`CN23XX_MAX_RINGS_PER_PF`). Casting the operand to `u64` ensures correct 64-bit arithmetic. Fixes: f21fb3ed364b ("Add support of Cavium Liquidio ethernet adapters") Signed-off-by: Alexey Nepomnyashih <sdl@nppct.ru> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-18Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"Tariq Toukan1-2/+0
This reverts commit d24341740fe48add8a227a753e68b6eedf4b385a. It causes errors when trying to configure QoS, as well as loss of L2 connectivity (on multi-host devices). Reported-by: Jakub Kicinski <kuba@kernel.org> Link: https://lore.kernel.org/20250910170011.70528106@kernel.org Fixes: d24341740fe4 ("net/mlx5e: Update and set Xon/Xoff upon port speed set") Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-18perf: arm_spe: Prevent overflow in PERF_IDX2OFF()Leo Yan1-1/+2
Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB). Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension") Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2025-09-18coresight: trbe: Prevent overflow in PERF_IDX2OFF()Leo Yan1-1/+2
Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB). Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2025-09-18drivers/perf: riscv: Remove redundant ternary operatorsLiao Yuanhong1-1/+1
For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com> Reviewed-by: Atish Patra <atishp@rivosinc.com> Link: https://lore.kernel.org/r/20250828122510.30843-1-liaoyuanhong@vivo.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-18drivers/perf: hisi: Add support for HiSilicon MN PMU driverJunhao He2-1/+412
MN (Miscellaneous Node) is a hybrid node in ARM CHI. It broadcasts the following two types of requests: DVM operations and PCIe configuration. MN PMU devices exist on both SCCL and SICL, so we named the MN pmu driver after SCL (Super cluster) ID. The MN PMU driver using the HiSilicon uncore PMU framework. And only the event parameter is supported. Signed-off-by: Junhao He <hejunhao3@huawei.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Yicong Yang <yangyicong@hisilicon.com> Signed-off-by: Will Deacon <will@kernel.org>
2025-09-18drivers/perf: hisi: Add support for HiSilicon NoC PMUYicong Yang2-1/+445
Adds the support for HiSilicon NoC (Network on Chip) PMU which will be used to monitor the events on the system bus. The PMU device will be named after the SCL ID (either Super CPU cluster or Super IO cluster) and the index ID, just similar to other HiSilicon Uncore PMUs. Below PMU formats are provided besides the event: - ch: the transaction channel (data, request, response, etc) which can be used to filter the counting. - tt_en: tracetag filtering enable. Just as other HiSilicon Uncore PMUs the NoC PMU supports only counting the transactions with tracetag. The NoC PMU doesn't have an interrupt to indicate the overflow. However we have a 64 bit counter which is large enough and it's nearly impossible to overflow. Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Yicong Yang <yangyicong@hisilicon.com> Signed-off-by: Will Deacon <will@kernel.org>
2025-09-18perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditionsYicong Yang1-2/+27
PMCCNTR_EL0 is preferred for counting CPU_CYCLES under certain conditions. Factor out the condition check to a separate function for further extension. Add documents for better understanding. No functional changes intended. Reviewed-by: James Clark <james.clark@linaro.org> Acked-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Yicong Yang <yangyicong@hisilicon.com> Signed-off-by: Will Deacon <will@kernel.org>
2025-09-18perf: arm_spe: Add support for FEAT_SPE_EFT extended filteringJames Clark1-0/+66
FEAT_SPE_EFT (optional from Armv9.4) adds mask bits for the existing load, store and branch filters. It also adds two new filter bits for SIMD and floating point with their own associated mask bits. The current filters only allow OR filtering on samples that are load OR store etc, and the new mask bits allow setting part of the filter to an AND, for example filtering samples that are store AND SIMD. With mask bits set to 0, the OR behavior is preserved, so the unless any masks are explicitly set old filters will behave the same. Add them all and make them behave the same way as existing format bits, hidden and return EOPNOTSUPP if set when the feature doesn't exist. Reviewed-by: Leo Yan <leo.yan@arm.com> Tested-by: Leo Yan <leo.yan@arm.com> Signed-off-by: James Clark <james.clark@linaro.org> Signed-off-by: Will Deacon <will@kernel.org>
2025-09-18perf: arm_spe: Expose event filterLeo Yan1-2/+20
Expose an "event_filter" entry in the caps folder to inform user space about which events can be filtered. Change the return type of arm_spe_pmu_cap_get() from u32 to u64 to accommodate the added event filter entry. Signed-off-by: Leo Yan <leo.yan@arm.com> Tested-by: Leo Yan <leo.yan@arm.com> Signed-off-by: James Clark <james.clark@linaro.org> Signed-off-by: Will Deacon <will@kernel.org>
2025-09-18perf: arm_spe: Support FEAT_SPEv1p4 filtersJames Clark1-16/+7
FEAT_SPEv1p4 (optional from Armv8.8) adds some new filter bits and also makes some previously available bits unavailable again e.g: E[30], bit [30] When FEAT_SPEv1p4 is _not_ implemented ... Continuing to hard code the valid filter bits for each version isn't scalable, and it also doesn't work for filter bits that aren't related to SPE version. For example most bits have a further condition: E[15], bit [15] When ... and filtering on event 15 is supported: Whether "filtering on event 15" is implemented or not is only discoverable from the TRM of that specific CPU or by probing PMSEVFR_EL1. Instead of hard coding them, write all 1s to the PMSEVFR_EL1 register and read it back to discover the RES0 bits. Unsupported bits are RAZ/WI so should read as 0s. For any hardware that doesn't strictly follow RAZ/WI for unsupported filters: Any bits that should have been supported in a specific SPE version but now incorrectly appear to be RES0 wouldn't have worked anyway, so it's better to fail to open events that request them rather than behaving unexpectedly. Bits that aren't implemented but also aren't RAZ/WI will be incorrectly reported as supported, but allowing them to be used is harmless. Testing on N1SDP shows the probed RES0 bits to be the same as the hard coded ones. The FVP with SPEv1p4 shows only additional new RES0 bits, i.e. no previously hard coded RES0 bits are missing. Tested-by: Leo Yan <leo.yan@arm.com> Signed-off-by: James Clark <james.clark@linaro.org> Signed-off-by: Will Deacon <will@kernel.org>
2025-09-18perf/dwc_pcie: Support counting multiple lane events in parallelIlkka Koskinen1-31/+130
While Designware PCIe PMU allows to count only one time based event at a time, it allows to count all the lane events simultaneously. After the patch one is able to count a group of lane events: $ perf stat -e '{dwc_rootport/tx_memory_write,lane=1/,dwc_rootport/rx_memory_read,lane=0/}' dd if=/dev/nvme0n1 of=/dev/null bs=1M count=1 Earlier the events wouldn't have been counted successfully. Signed-off-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Will Deacon <will@kernel.org>
2025-09-18drivers: perf: use us_to_ktime() where appropriateXichao Zhao1-1/+1
The arm_ccn_pmu_poll_period_us are more suitable for using the us_to_ktime(). This can make the code more concise and enhance readability. Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com> Acked-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2025-09-18perf: imx_perf: add support for i.MX94 platformXu Yang1-0/+6
Add compatible string and related devtype for i.MX94 platform. Reviewed-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Xu Yang <xu.yang_2@nxp.com> Signed-off-by: Will Deacon <will@kernel.org>
2025-09-18EDAC/versalnet: Return the correct error in mc_probe()Dan Carpenter1-1/+3
Return -ENOMEM if memory allocation in mc_probe() fails. [ bp: Massage commit message. ] Fixes: d5fe2fec6c40 ("EDAC: Add a driver for the AMD Versal NET DDR controller") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
2025-09-18Merge tag 'ib-mfd-gpio-input-pinctrl-pwm-v6.18' of ↵Bartosz Golaszewski19-2/+1455
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into gpio/for-next Pull changes from the immutable branch between MFD, GPIO, Input, Pinctrl and PWM trees containing the GPIO driver for max7360.
2025-09-18Merge tag 'ib-mfd-gpio-hwmon-i2c-can-rtc-watchdog-v6.18' of ↵Bartosz Golaszewski21-0/+3555
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into gpio/for-next Pull changes from the immutable branch between MFD, GPIO, HWMON, I2C, CAN, RTC and Watchdog trees containing GPIO support for Nuvoton NCT6694.
2025-09-18Merge tag 'mm-hotfixes-stable-2025-09-17-21-10' of ↵Linus Torvalds1-5/+3
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "15 hotfixes. 11 are cc:stable and the remainder address post-6.16 issues or aren't considered necessary for -stable kernels. 13 of these fixes are for MM. The usual shower of singletons, plus - fixes from Hugh to address various misbehaviors in get_user_pages() - patches from SeongJae to address a quite severe issue in DAMON - another series also from SeongJae which completes some fixes for a DAMON startup issue" * tag 'mm-hotfixes-stable-2025-09-17-21-10' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: zram: fix slot write race condition nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* samples/damon/mtier: avoid starting DAMON before initialization samples/damon/prcl: avoid starting DAMON before initialization samples/damon/wsse: avoid starting DAMON before initialization MAINTAINERS: add Lance Yang as a THP reviewer MAINTAINERS: add Jann Horn as rmap reviewer mm/damon/sysfs: use dynamically allocated repeat mode damon_call_control mm/damon/core: introduce damon_call_control->dealloc_on_cancel mm: folio_may_be_lru_cached() unless folio_test_large() mm: revert "mm: vmscan.c: fix OOM on swap stress test" mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" mm/gup: local lru_add_drain() to avoid lru_add_drain_all() mm/gup: check ref_count instead of lru before migration
2025-09-18drm/xe/guc: Set RCS/CCS yield policyDaniele Ceraolo Spurio6-5/+98
All recent platforms (including all the ones officially supported by the Xe driver) do not allow concurrent execution of RCS and CCS workloads from different address spaces, with the HW blocking the context switch when it detects such a scenario. The DUAL_QUEUE flag helps with this, by causing the GuC to not submit a context it knows will not be able to execute. This, however, causes a new problem: if RCS and CCS queues have pending workloads from different address spaces, the GuC needs to choose from which of the 2 queues to pick the next workload to execute. By default, the GuC prioritizes RCS submissions over CCS ones, which can lead to CCS workloads being significantly (or completely) starved of execution time. The driver can tune this by setting a dedicated scheduling policy KLV; this KLV allows the driver to specify a quantum (in ms) and a ratio (percentage value between 0 and 100), and the GuC will prioritize the CCS for that percentage of each quantum. Given that we want to guarantee enough RCS throughput to avoid missing frames, we set the yield policy to 20% of each 80ms interval. v2: updated quantum and ratio, improved comment, use xe_guc_submit_disable in gt_sanitize Fixes: d9a1ae0d17bd ("drm/xe/guc: Enable WA_DUAL_QUEUE for newer platforms") Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: John Harrison <John.C.Harrison@Intel.com> Cc: Vinay Belgaumkar <vinay.belgaumkar@intel.com> Reviewed-by: John Harrison <John.C.Harrison@Intel.com> Tested-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com> Link: https://lore.kernel.org/r/20250905235632.3333247-2-daniele.ceraolospurio@intel.com (cherry picked from commit 88434448438e4302e272b2a2b810b42e05ea024b) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> [Rodrigo added #include "xe_guc_submit.h" while backporting]
2025-09-18Merge branch '100GbE' of ↵Jakub Kicinski6-63/+56
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-09-16 (ice, i40e, ixgbe, igc) For ice: Jake resolves leaking pages with multi-buffer frames when a 0-sized descriptor is encountered. For i40e: Maciej removes a redundant, and incorrect, memory barrier. For ixgbe: Jedrzej adjusts lifespan of ACI lock to ensure uses are while it is valid. For igc: Kohei Enju does not fail probe on LED setup failure which resolves a kernel panic in the cleanup path, if we were to fail. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: igc: don't fail igc_probe() on LED setup error ixgbe: destroy aci.lock later within ixgbe_remove path ixgbe: initialize aci.lock before it's used i40e: remove redundant memory barrier when cleaning Tx descs ice: fix Rx page leak on multi-buffer frames ==================== Link: https://patch.msgid.link/20250916212801.2818440-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-18Merge tag 'wireless-2025-09-17' of ↵Jakub Kicinski1-1/+1
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Just two fixes: - fix crash in rfkill due to uninitialized type_name - fix aggregation in iwlwifi 7000/8000 devices * tag 'wireless-2025-09-17' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer wifi: iwlwifi: pcie: fix byte count table for some devices ==================== Link: https://patch.msgid.link/20250917105159.161583-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-18power: supply: qcom_battmgr: Add charge control supportFenglin Wu1-2/+273
Add charge control support for SM8550 and X1E80100. It's supported with below two power supply properties: charge_control_end_threshold: The battery SoC (State of Charge) threshold at which the charging should be terminated. charge_control_start_threshold: The battery SoC threshold at which the charging should be resumed. Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on Thinkpad T14S OLED Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-18power: supply: qcom_battmgr: update compats for SM8550 and X1E80100Fenglin Wu1-7/+15
The SM8550 and X1E80100 platforms now include charge control functionality in battery management firmware, allowing charging to stop when the battery reaches a set level and resume when it drops below another level. To support this in the qcom_battmgr driver, CHARGE_CONTROL_START/END_THRESHOLD power supply properties can be added to manage these levels. This results in the battery power supply properties for SM8550 and X1E80100 differing from those for SM8350 and SC8280XP. Therefore, separate compatible entries for SM8550 and X1E80100 are introduced, each with their own variant definitions as match data. Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-18power: supply: qcom_battmgr: Add state_of_health propertyFenglin Wu1-0/+9
Add state_of_health property to read battery health percentage from battery management firmware. Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-18power: supply: qcom_battmgr: Add resistance power supply propertyFenglin Wu1-0/+10
Add power supply property to get battery internal resistance from the battery management firmware. Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-18power: supply: core: Add state_of_health power supply propertyFenglin Wu1-0/+1
Add state_of_health power supply property to represent battery health percentage. Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-18power: supply: core: Add resistance power supply propertyFenglin Wu1-0/+1
Some battery drivers provide the ability to export internal resistance as a parameter. Add internal_resistance power supply property for that purpose. Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-18power: supply: rx51: remove redundant condition checksXichao Zhao1-1/+1
Remove redundant condition checks and replace else if with else. Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-18octeon_ep: fix VF MAC address lifecycle handlingSathesh B Edara1-0/+3
Currently, VF MAC address info is not updated when the MAC address is configured from VF, and it is not cleared when the VF is removed. This leads to stale or missing MAC information in the PF, which may cause incorrect state tracking or inconsistencies when VFs are hot-plugged or reassigned. Fix this by: - storing the VF MAC address in the PF when it is set from VF - clearing the stored VF MAC address when the VF is removed This ensures that the PF always has correct VF MAC state. Fixes: cde29af9e68e ("octeon_ep: add PF-VF mailbox communication") Signed-off-by: Sathesh B Edara <sedara@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20250916133207.21737-1-sedara@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-18bonding: don't set oif to bond dev when getting NS target destinationHangbin Liu1-1/+0
Unlike IPv4, IPv6 routing strictly requires the source address to be valid on the outgoing interface. If the NS target is set to a remote VLAN interface, and the source address is also configured on a VLAN over a bond interface, setting the oif to the bond device will fail to retrieve the correct destination route. Fix this by not setting the oif to the bond device when retrieving the NS target destination. This allows the correct destination device (the VLAN interface) to be determined, so that bond_verify_device_path can return the proper VLAN tags for sending NS messages. Reported-by: David Wilder <wilder@us.ibm.com> Closes: https://lore.kernel.org/netdev/aGOKggdfjv0cApTO@fedora/ Suggested-by: Jay Vosburgh <jv@jvosburgh.net> Tested-by: David Wilder <wilder@us.ibm.com> Acked-by: Jay Vosburgh <jv@jvosburgh.net> Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets") Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Link: https://patch.msgid.link/20250916080127.430626-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-17serial: qcom-geni: Load UART qup Firmware from linux sideViken Dadhaniya1-1/+7
Add provision to load firmware of Serial engine for UART protocol from Linux Execution Environment on running on APPS processor. Co-developed-by: Mukesh Kumar Savaliya <mukesh.savaliya@oss.qualcomm.com> Signed-off-by: Mukesh Kumar Savaliya <mukesh.savaliya@oss.qualcomm.com> Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com> Link: https://lore.kernel.org/r/20250911043256.3523057-7-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-09-17spi: geni-qcom: Load spi qup Firmware from linux sideViken Dadhaniya1-0/+6
Add provision to load firmware of Serial engine for SPI protocol from Linux Execution Environment on running on APPS processor. Co-developed-by: Mukesh Kumar Savaliya <mukesh.savaliya@oss.qualcomm.com> Signed-off-by: Mukesh Kumar Savaliya <mukesh.savaliya@oss.qualcomm.com> Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com> Acked-by: Mark Brown <broonie@kernel.org> Link: https://lore.kernel.org/r/20250911043256.3523057-6-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-09-17i2c: qcom-geni: Load i2c qup Firmware from linux sideViken Dadhaniya1-1/+7
Add provision to load firmware of Serial engine for I2C protocol from Linux Execution Environment on running on APPS processor. Acked-by: Andi Shyti <andi.shyti@kernel.org> Co-developed-by: Mukesh Kumar Savaliya <mukesh.savaliya@oss.qualcomm.com> Signed-off-by: Mukesh Kumar Savaliya <mukesh.savaliya@oss.qualcomm.com> Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com> Link: https://lore.kernel.org/r/20250911043256.3523057-5-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-09-17soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystemViken Dadhaniya1-3/+471
In Qualcomm SoCs, firmware loading for Serial Engines (SE) within the QUP hardware has traditionally been managed by TrustZone (TZ). This restriction poses a significant challenge for developers, as it limits their ability to enable various protocols on any of the SEs from the Linux side, reducing flexibility. Load the firmware to QUP SE based on the 'firmware-name' property specified in devicetree at bootup time. Co-developed-by: Mukesh Kumar Savaliya <mukesh.savaliya@oss.qualcomm.com> Signed-off-by: Mukesh Kumar Savaliya <mukesh.savaliya@oss.qualcomm.com> Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com> Link: https://lore.kernel.org/r/20250911043256.3523057-4-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-09-17soc: qcom: geni-se: Cleanup register defines and update copyrightViken Dadhaniya1-16/+16
Refactor register macros for consistency and clarity and remove redundant definitions and update naming for better alignment. Update copyright to include Qualcomm Technologies, Inc. Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com> Link: https://lore.kernel.org/r/20250911043256.3523057-3-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-09-17regulator: Fix MAX77838 selectionIgor Belwon1-1/+2
The current entry for the MAX77838 regulator is unselectable (as it depended on a non-user-selectable config - REGMAP_I2C). Fix this by making it select the config, and not depending on it. Signed-off-by: Igor Belwon <igor.belwon@mentallysanemainliners.org> Link: https://patch.msgid.link/20250917-maxreg-kconfig-fix-v1-1-1369f88d6272@mentallysanemainliners.org Signed-off-by: Mark Brown <broonie@kernel.org>
2025-09-17drm/xe: Fix error handling if PXP fails to startDaniele Ceraolo Spurio6-41/+72
Since the PXP start comes after __xe_exec_queue_init() has completed, we need to cleanup what was done in that function in case of a PXP start error. __xe_exec_queue_init calls the submission backend init() function, so we need to introduce an opposite for that. Unfortunately, while we already have a fini() function pointer, it performs other operations in addition to cleaning up what was done by the init(). Therefore, for clarity, the existing fini() has been renamed to destroy(), while a new fini() has been added to only clean up what was done by the init(), with the latter being called by the former (via xe_exec_queue_fini). Fixes: 72d479601d67 ("drm/xe/pxp/uapi: Add userspace and LRC support for PXP-using queues") Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Cc: John Harrison <John.C.Harrison@Intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Reviewed-by: John Harrison <John.C.Harrison@Intel.com> Signed-off-by: John Harrison <John.C.Harrison@Intel.com> Link: https://lore.kernel.org/r/20250909221240.3711023-3-daniele.ceraolospurio@intel.com (cherry picked from commit 626667321deb4c7a294725406faa3dd71c3d445d) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2025-09-17drm/xe/sysfs: Add cleanup action in xe_device_sysfs_initZongyao Bai1-2/+6
On partial failure, some sysfs files created before the failure might not be removed. Add common cleanup step to remove them all immediately, as is should be harmless to attempt to remove non-existing files. Fixes: 0e414bf7ad01 ("drm/xe: Expose PCIe link downgrade attributes") Cc: Lucas De Marchi <lucas.demarchi@intel.com> Cc: Stuart Summers <stuart.summers@intel.com> Cc: Shuicheng Lin <shuicheng.lin@intel.com> Cc: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Zongyao Bai <zongyao.bai@intel.com> Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com> Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com> Link: https://lore.kernel.org/r/20250915214716.1327379-2-zongyao.bai@intel.com Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com> (cherry picked from commit 1a869168d91f1a1a2b0db22cea0295c67908e5d8) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2025-09-17firewire: core: use struct_size and flex_array_size in ioctl_add_descriptorThorsten Blum1-2/+3
Use struct_size() to determine the memory needed for a new 'struct descriptor_resource' and flex_array_size() to calculate the number of bytes to copy from userspace. This removes the hardcoded size (4 bytes) for the 'u32 data[]' entries. No functional changes intended. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://lore.kernel.org/r/20250916122143.2459993-3-thorsten.blum@linux.dev Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2025-09-17Merge tag 'for-6.17/dm-fixes' of ↵Linus Torvalds3-6/+12
git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mikulas Patocka: - fix integer overflow in dm-stripe - limit tag size in dm-integrity to 255 bytes - fix 'alignment inconsistency' warning in dm-raid * tag 'for-6.17/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm-raid: don't set io_min and io_opt for raid1 dm-integrity: limit MAX_TAG_SIZE to 255 dm-stripe: fix a possible integer overflow
2025-09-17mmc: select REGMAP_MMIO with MMC_LOONGSON2Mikko Rapeli1-0/+1
COMPILE_TEST with MMC_LOONGSON2 failed to link due to undeclared dependency: ERROR: modpost: "__devm_regmap_init_mmio_clk" [drivers/mmc/host/loongson2-mmc.ko] undefined! Fixes: 2115772014bd ("mmc: loongson2: Add Loongson-2K SD/SDIO controller driver") Suggested-by: Arnd Bergmann <arnd@arndb.de> Suggested-by: Binbin Zhou <zhoubinbin@loongson.cn> Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-09-17mmc: add COMPILE_TEST to multiple driversMikko Rapeli1-4/+5
These compile on x86_64 with =y and =m. Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-09-17pmdomain: mediatek: airoha: convert from round_rate() to determine_rate()Brian Masney1-4/+4
The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch appended to the "under-the-cut" portion of the patch. Note that prior to running the Coccinelle, airoha_cpu_pmdomain_clk_round() was renamed to airoha_cpu_pmdomain_clk_round_rate(). Signed-off-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-09-17drbd: init queue_limits->max_hw_wzeroes_unmap_sectors parameterZhang Yi1-0/+1
The parameter max_hw_wzeroes_unmap_sectors in queue_limits should be equal to max_write_zeroes_sectors if it is set to a non-zero value. However, when the backend bdev is specified, this parameter is initialized to UINT_MAX during the call to blk_set_stacking_limits(), while only max_write_zeroes_sectors is adjusted. Therefore, this discrepancy triggers a value check failure in blk_validate_limits(). Since the drvd driver doesn't yet support unmap write zeroes, so fix this failure by explicitly setting max_hw_wzeroes_unmap_sectors to zero. Fixes: 0c40d7cb5ef3 ("block: introduce max_{hw|user}_wzeroes_unmap_sectors to queue limits") Signed-off-by: Zhang Yi <yi.zhang@huawei.com> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Yu Kuai <yukuai3@huawei.com> Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-09-17pmdomain: rockchip: enable ROCKCHIP_PM_DOMAINS with ARCH_ROCKCHIPMikko Rapeli1-0/+1
On rk3399 based rockpi4b, mounting rootfs from mmc fails unless ROCKCHIP_PM_DOMAINS is enabled. Accoriding to Heiko Stübner <heiko@sntech.de> all SoCs since 2012 have power domains so the support should be enabled by default on both arm and arm64. Failing boot without CONFIG_ROCKCHIP_PM_DOMAINS=y: https://ledge.validation.linaro.org/scheduler/job/119268 /dev/disk/by-partuuid/1d48ffd8-f2a7-4a33-b52f-186089b3c85e: Can't lookup blockdev /dev/disk/by-partuuid/1d48ffd8-f2a7-4a33-b52f-186089b3c85e: Can't lookup blockdev /dev/disk/by-partuuid/1d48ffd8-f2a7-4a33-b52f-186089b3c85e: Can't lookup blockdev /dev/disk/by-partuuid/1d48ffd8-f2a7-4a33-b52f-186089b3c85e: Can't lookup blockdev /dev/disk/by-partuuid/1d48ffd8-f2a7-4a33-b52f-186089b3c85e: Can't lookup blockdev /dev/disk/by-partuuid/1d48ffd8-f2a7-4a33-b52f-186089b3c85e: Can't lookup blockdev dw-apb-uart ff1a0000.serial: forbid DMA for kernel console root '/dev/disk/by-partuuid/1d48ffd8-f2a7-4a33-b52f-186089b3c85e' doesn't exist or does not contain a /dev. rk_gmac-dwmac fe300000.ethernet: deferred probe timeout, ignoring dependency rk_gmac-dwmac fe300000.ethernet: probe with driver rk_gmac-dwmac failed with error -110 rk_iommu ff650800.iommu: deferred probe timeout, ignoring dependency rk_iommu ff650800.iommu: probe with driver rk_iommu failed with error -110 dwmmc_rockchip fe320000.mmc: deferred probe timeout, ignoring dependency rockchip-typec-phy ff7c0000.phy: deferred probe timeout, ignoring dependency dwmmc_rockchip fe320000.mmc: probe with driver dwmmc_rockchip failed with error -110 rockchip-typec-phy ff7c0000.phy: probe with driver rockchip-typec-phy failed with error -110 rockchip-typec-phy ff800000.phy: deferred probe timeout, ignoring dependency rockchip-typec-phy ff800000.phy: probe with driver rockchip-typec-phy failed with error -110 rk_iommu ff660480.iommu: deferred probe timeout, ignoring dependency rk_iommu ff660480.iommu: probe with driver rk_iommu failed with error -110 rk_iommu ff8f3f00.iommu: deferred probe timeout, ignoring dependency rk_iommu ff8f3f00.iommu: probe with driver rk_iommu failed with error -110 rk_iommu ff903f00.iommu: deferred probe timeout, ignoring dependency rk_iommu ff903f00.iommu: probe with driver rk_iommu failed with error -110 rk_iommu ff914000.iommu: deferred probe timeout, ignoring dependency rk_iommu ff914000.iommu: probe with driver rk_iommu failed with error -110 rk_iommu ff924000.iommu: deferred probe timeout, ignoring dependency rk_iommu ff924000.iommu: probe with driver rk_iommu failed with error -110 platform fe800000.usb: deferred probe pending: platform: wait for supplier /phy@ff7c0000/usb3-port sdhci-arasan fe330000.mmc: deferred probe timeout, ignoring dependency platform fe900000.usb: deferred probe pending: platform: wait for supplier /phy@ff800000/usb3-port sdhci-arasan fe330000.mmc: probe with driver sdhci-arasan failed with error -110 platform ff1d0000.spi: deferred probe pending: (reason unknown) platform hdmi-sound: deferred probe pending: asoc-simple-card: parse error Working boot with CONFIG_ROCKCHIP_PM_DOMAINS=y: https://ledge.validation.linaro.org/scheduler/job/119272 dwmmc_rockchip fe320000.mmc: IDMAC supports 32-bit address mode. dwmmc_rockchip fe320000.mmc: Using internal DMA controller. dwmmc_rockchip fe320000.mmc: Version ID is 270a dwmmc_rockchip fe320000.mmc: DW MMC controller at irq 45,32 bit host data width,256 deep fifo dwmmc_rockchip fe320000.mmc: Got CD GPIO ff1a0000.serial: ttyS2 at MMIO 0xff1a0000 (irq = 44, base_baud = 1500000) is a 16550A printk: legacy console [ttyS2] enabled mmc_host mmc1: Bus speed (slot 0) = 400000Hz (slot req 400000Hz, actual 400000HZ div = 0) dw_wdt ff848000.watchdog: No valid TOPs array specified mmc_host mmc1: Bus speed (slot 0) = 50000000Hz (slot req 50000000Hz, actual 50000000HZ div = 0) mmc0: CQHCI version 5.10 rk_gmac-dwmac fe300000.ethernet: IRQ eth_wake_irq not found mmc1: new high speed SDHC card at address aaaa fan53555-regulator 0-0040: FAN53555 Option[8] Rev[1] Detected! fan53555-regulator 0-0041: FAN53555 Option[8] Rev[1] Detected! rk_gmac-dwmac fe300000.ethernet: IRQ eth_lpi not found mmcblk1: mmc1:aaaa SC16G 14.8 GiB rk_gmac-dwmac fe300000.ethernet: IRQ sfty not found GPT:Primary header thinks Alt. header is not at the end of the disk. rk_gmac-dwmac fe300000.ethernet: Deprecated MDIO bus assumption used GPT:1978417 != 31116287 rk_gmac-dwmac fe300000.ethernet: PTP uses main clock GPT:Alternate GPT header not at the end of the disk. rk_gmac-dwmac fe300000.ethernet: clock input or output? (input). GPT:1978417 != 31116287 rk_gmac-dwmac fe300000.ethernet: TX delay(0x28). GPT: Use GNU Parted to correct GPT errors. rk_gmac-dwmac fe300000.ethernet: RX delay(0x11). mmcblk1: p1 p2 p3 p4 p5 p6 p7 p8 Acked-by: Heiko Stuebner <heiko@sntech.de> Acked-by: Arnd Bergmann <arnd@arndb.de> Suggested-by: Ulf Hansson <ulf.hansson@linaro.org> Suggested-by: Heiko Stübner <heiko@sntech.de> Suggested-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-09-17pmdomain: marvell: Add PXA1908 power domainsDuje Mihanović5-0/+297
Marvell's PXA1908 SoC has a few power domains for its VPU, GPU, image processor and DSI PHY. Add a driver to control these. Signed-off-by: Duje Mihanović <duje@dujemihanovic.xyz> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-09-17dm-raid: don't set io_min and io_opt for raid1Mikulas Patocka1-2/+4
These commands modprobe brd rd_size=1048576 vgcreate vg /dev/ram* lvcreate -m4 -L10 -n lv vg trigger the following warnings: device-mapper: table: 252:10: adding target device (start sect 0 len 24576) caused an alignment inconsistency device-mapper: table: 252:10: adding target device (start sect 0 len 24576) caused an alignment inconsistency The warnings are caused by the fact that io_min is 512 and physical block size is 4096. If there's chunk-less raid, such as raid1, io_min shouldn't be set to zero because it would be raised to 512 and it would trigger the warning. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Cc: stable@vger.kernel.org
2025-09-17spi: mt65xx: add dual and quad mode for standard spi deviceTim Kuo1-3/+25
Mediatek SPI hardware natively supports dual and quad modes, and these modes are already enabled for SPI flash devices under spi-mem framework in MTK SPI controller spi-mt65xx. However, other SPI devices, such as touch panels, are limited to single mode because spi-mt65xx lacks SPI mode argument parsing from SPI framework for these SPI devices outside spi-mem framework. This patch adds dual and quad mode support for these SPI devices by introducing a new API, mtk_spi_set_nbits, for SPI mode argument parsing. Signed-off-by: Tim Kuo <Tim.Kuo@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Link: https://patch.msgid.link/20250917055839.500615-1-Tim.Kuo@mediatek.com Signed-off-by: Mark Brown <broonie@kernel.org>
generated by cgit v1.2.3 (git 2.39.0) at 2025-10-03 07:12:10 +0300