summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-03-24drm/display: hdmi: Convert to drm_output_color_formatMaxime Ripard1-4/+4
Now that we introduced a new drm_output_color_format enum to represent what DRM_COLOR_FORMAT_* bits were representing, we can switch to the new enum. The main difference is that while DRM_COLOR_FORMAT_ was a bitmask, drm_output_color_format is a proper enum. However, the enum was done is such a way than DRM_COLOR_FORMAT_X = BIT(DRM_OUTPUT_COLOR_FORMAT_X) so the transitition is easier. The only thing we need to consider is if the original code meant to use that value as a bitmask, in which case we do need to keep the bit shift, or as a discriminant in which case we don't. Acked-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-3-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
2026-03-24drm/edid: Convert to drm_output_color_format enumMaxime Ripard1-9/+9
Now that we introduced a new drm_output_color_format enum to represent what DRM_COLOR_FORMAT_* bits were representing, we can switch to the new enum. The main difference is that while DRM_COLOR_FORMAT_ was a bitmask, drm_output_color_format is a proper enum. However, the enum was done is such a way than DRM_COLOR_FORMAT_X = BIT(DRM_OUTPUT_COLOR_FORMAT_X) so the transitition is easier. The only thing we need to consider is if the original code meant to use that value as a bitmask, in which case we do need to keep the bit shift, or as a discriminant in which case we don't. Acked-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-2-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
2026-03-24Merge branch 'ib-scmi-pinctrl-gpio' into develLinus Walleij7-13/+187
2026-03-24gpio: gpio-by-pinctrl: add pinctrl based generic GPIO driverAKASHI Takahiro3-0/+115
The ARM SCMI pinctrl protocol allows GPIO access. Instead of creating a new SCMI GPIO driver, this driver is a generic GPIO driver that uses standard pinctrl interfaces. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Linus Walleij <linusw@kernel.org> Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-24firmware: arm_scmi: Allow PINCTRL_REQUEST to return EOPNOTSUPPDan Carpenter1-0/+2
The SCMI protocol specification says that the PINCTRL_REQUEST and PINCTRL_RELEASE commands are optional. So if the SCMI server returns -EOPNOTSUPP, then treat that as success and continue. Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-24pinctrl: scmi: ignore PIN_CONFIG_PERSIST_STATEDan Carpenter1-4/+8
The PIN_CONFIG_PERSIST_STATE setting ensures that the pin state persists across a sleep or controller reset. The SCMI spec does not have an equivalent command to this so just ignore it. Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-24pinctrl: scmi: Delete PIN_CONFIG_OUTPUT_IMPEDANCE_OHMS supportDan Carpenter1-3/+0
The argument for PIN_CONFIG_OUTPUT_IMPEDANCE_OHMS is supposed to be expressed in terms of ohms. But the pinctrl-scmi driver was implementing it the same as PIN_CONFIG_OUTPUT and writing either a zero or one to the pin. The SCMI protocol doesn't have an support configuration type so just delete this code instead of replacing it. Cc: Peng Fan <peng.fan@nxp.com> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-24pinctrl: scmi: Add SCMI_PIN_INPUT_VALUEDan Carpenter1-7/+26
The PIN_CONFIG_LEVEL parameter represents the value of the pin, whether reading or writing to the pin. In SCMI, the parameter is represented by two different values SCMI_PIN_OUTPUT_VALUE for writing to a pin and SCMI_PIN_INPUT_VALUE for reading. The current code translates PIN_CONFIG_LEVEL as SCMI_PIN_OUTPUT_VALUE (writing). Add a function to translate it to either INPUT or OUTPUT depending on whether it is called from a _get or _set() operation. Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Linus Walleij <linusw@kernel.org> Acked-by: Sudeep Holla <sudeep.holla@kernel.org> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-24pinctrl: introduce pinctrl_gpio_get_config()AKASHI Takahiro2-0/+37
This is a counterpart of pinctrl_gpio_set_config(), which will be used to implement the ->get() interface in a GPIO driver for SCMI. This also requires that we create a stub so pin_config_get_for_pin() can build when CONFIG_PINCONF is disabled. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-24clk: samsung: exynos850: Add APM-to-AP mailbox clockAlexey Klimov1-1/+6
Add APM mailbox clock for communicating between APM and main application CPUs in CMU_APM unit. This clock is needed to access this mailbox registers. This mailbox is used for ACPM communication between kernel and APM co-processor. Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org> Link: https://patch.msgid.link/20260320-exynos850-ap2apm-mailbox-v1-2-983eb3f296fc@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-03-24net: airoha: Rework the code flow in airoha_remove() and in airoha_probe() ↵Lorenzo Bianconi1-32/+44
error path As suggested by Simon in [0], rework the code flow in airoha_remove() and in the airoha_probe() error path in order to rely on a more common approach un-registering configured net-devices first and destroying the hw resources at the end of the code. Introduce airoha_qdma_cleanup routine to release QDMA resources. [0] https://lore.kernel.org/netdev/20251214-airoha-fix-dev-registration-v1-1-860e027ad4c6@kernel.org/ Suggested-by: Simon Horman <horms@kernel.org> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260321-airoha-remove-rework-v2-1-16c7bade5fe5@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24perf: add NVIDIA Tegra410 C2C PMUBesar Wicaksono3-0/+1059
Adds NVIDIA C2C PMU support in Tegra410 SOC. This PMU is used to measure memory latency between the SOC and device memory, e.g GPU Memory (GMEM), CXL Memory, or memory on remote Tegra410 SOC. Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Besar Wicaksono <bwicaksono@nvidia.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-03-24perf: add NVIDIA Tegra410 CPU Memory Latency PMUBesar Wicaksono3-0/+744
Adds CPU Memory (CMEM) Latency PMU support in Tegra410 SOC. The PMU is used to measure latency between the edge of the Unified Coherence Fabric to the local system DRAM. Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Besar Wicaksono <bwicaksono@nvidia.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-03-24perf/arm_cspmu: nvidia: Add Tegra410 PCIE-TGT PMUBesar Wicaksono1-0/+321
Adds PCIE-TGT PMU support in Tegra410 SOC. This PMU is instanced in each root complex in the SOC and it captures traffic originating from any source towards PCIE BAR and CXL HDM range. The traffic can be filtered based on the destination root port or target address range. Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Besar Wicaksono <bwicaksono@nvidia.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-03-24perf/arm_cspmu: nvidia: Add Tegra410 PCIE PMUBesar Wicaksono1-5/+205
Adds PCIE PMU support in Tegra410 SOC. This PMU is instanced in each root complex in the SOC and can capture traffic from PCIE device to various memory types. This PMU can filter traffic based on the originating root port or BDF and the target memory types (CPU DRAM, GPU Memory, CXL Memory, or remote Memory). Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Besar Wicaksono <bwicaksono@nvidia.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-03-24perf/arm_cspmu: Add arm_cspmu_acpi_dev_getBesar Wicaksono2-2/+34
Add interface to get ACPI device associated with the PMU. This ACPI device may contain additional properties not covered by the standard properties. Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Besar Wicaksono <bwicaksono@nvidia.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-03-24perf/arm_cspmu: nvidia: Add Tegra410 UCF PMUBesar Wicaksono1-1/+86
The Unified Coherence Fabric (UCF) contains last level cache and cache coherent interconnect in Tegra410 SOC. The PMU in this device can be used to capture events related to access to the last level cache and memory from different sources. Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Besar Wicaksono <bwicaksono@nvidia.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-03-24perf/arm-cmn: Stop claiming entire iomem regionRobin Murphy1-38/+30
So far, the PMU has been the only thing of interest in the vast mass of CMN registers, so we've gotten away with simply claiming the entire iomem region. However, now that we can support other features like MPAM controllers for the system caches, the PMU driver needs to stop being selfish and learn to share. Similarly to arm-ni, requesting just the DTC node(s) should suffice for staking our exclusive claim to the PMU features, as requesting hundreds of tiny regions for all the individual pmu_event_sel registers is definitely not worth the considerable bother. As a consequence, we can also streamline the annoying CMN-600 special cases even more. The ACPI binding has in fact always specified a strict order for all resources, so we can reasonably drop the ancient pretence of swapping base and cfg, which IIRC was more just a moment of doubt on my part than anything else. Cc: James Morse <james.morse@arm.com> Signed-off-by: Robin Murphy <robin.murphy@arm.com> Tested-by: Ben Horgan <ben.horgan@arm.com> Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-03-24net: macb: Use dev_consume_skb_any() to free TX SKBsKevin Hao1-1/+1
The napi_consume_skb() function is not intended to be called in an IRQ disabled context. However, after commit 6bc8a5098bf4 ("net: macb: Fix tx_ptr_lock locking"), the freeing of TX SKBs is performed with IRQs disabled. To resolve the following call trace, use dev_consume_skb_any() for freeing TX SKBs: WARNING: kernel/softirq.c:430 at __local_bh_enable_ip+0x174/0x188, CPU#0: ksoftirqd/0/15 Modules linked in: CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 7.0.0-rc4-next-20260319-yocto-standard-dirty #37 PREEMPT Hardware name: ZynqMP ZCU102 Rev1.1 (DT) pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __local_bh_enable_ip+0x174/0x188 lr : local_bh_enable+0x24/0x38 sp : ffff800082b3bb10 x29: ffff800082b3bb10 x28: ffff0008031f3c00 x27: 000000000011ede0 x26: ffff000800a7ff00 x25: ffff800083937ce8 x24: 0000000000017a80 x23: ffff000803243a78 x22: 0000000000000040 x21: 0000000000000000 x20: ffff000800394c80 x19: 0000000000000200 x18: 0000000000000001 x17: 0000000000000001 x16: ffff000803240000 x15: 0000000000000000 x14: ffffffffffffffff x13: 0000000000000028 x12: ffff000800395650 x11: ffff8000821d1528 x10: ffff800081c2bc08 x9 : ffff800081c1e258 x8 : 0000000100000301 x7 : ffff8000810426ec x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000008 x1 : 0000000000000200 x0 : ffff8000810428dc Call trace: __local_bh_enable_ip+0x174/0x188 (P) local_bh_enable+0x24/0x38 skb_attempt_defer_free+0x190/0x1d8 napi_consume_skb+0x58/0x108 macb_tx_poll+0x1a4/0x558 __napi_poll+0x50/0x198 net_rx_action+0x1f4/0x3d8 handle_softirqs+0x16c/0x560 run_ksoftirqd+0x44/0x80 smpboot_thread_fn+0x1d8/0x338 kthread+0x120/0x150 ret_from_fork+0x10/0x20 irq event stamp: 29751 hardirqs last enabled at (29750): [<ffff8000813be184>] _raw_spin_unlock_irqrestore+0x44/0x88 hardirqs last disabled at (29751): [<ffff8000813bdf60>] _raw_spin_lock_irqsave+0x38/0x98 softirqs last enabled at (29150): [<ffff8000800f1aec>] handle_softirqs+0x504/0x560 softirqs last disabled at (29153): [<ffff8000800f2fec>] run_ksoftirqd+0x44/0x80 Fixes: 6bc8a5098bf4 ("net: macb: Fix tx_ptr_lock locking") Signed-off-by: Kevin Hao <haokexin@gmail.com> Cc: stable@vger.kernel.org Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260321-macb-tx-v1-1-b383a58dd4e6@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24net: phy: update outdated comment for removed phy_package_read/write()Kexin Sun1-2/+2
The locked convenience functions phy_package_read() and phy_package_write() were removed (as they had no users) by commit e7f984e925d2 ("net: phy: move PHY package related code from phy.h to phy_package.c"). Update the comment to reference the existing unlocked counterparts __phy_package_read() and __phy_package_write(). Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun <kexinsun@smail.nju.edu.cn> Link: https://patch.msgid.link/20260321105825.7221-1-kexinsun@smail.nju.edu.cn Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24wifi: iwlwifi: mld: correctly set wifi generation dataJohannes Berg2-32/+88
In each MAC context, the firmware expects the wifi generation data, i.e. whether or not HE/EHT (and in the future UHR) is enabled on that MAC. However, this is currently handled wrong in two ways: - EHT is only enabled when the interface is also an MLD, but we currently allow (despite the spec) connecting with EHT but without MLO. - when HE or EHT are used by TDLS peers, the firmware needs to have them enabled regardless of the AP Fix this by iterating setting up the data depending on the interface type: - for AP, just set it according to the BSS configuration - for monitor, set it according to HW capabilities - otherwise, particularly for client, iterate all stations and then their links on the interface in question and set according to their capabilities, this handles the AP and TDLS peers. Re-calculate this whenever a TDLS station is marked associated or removed so that it's kept updated, for the AP it's already updated on assoc/disassoc. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.404713b22177.Ic972b5e557d011a5438f8f97c1e793cc829e2ea9@changeid Link: https://patch.msgid.link/20260324093333.2953495-1-miriam.rachel.korenblit@intel.com
2026-03-24wifi: iwlwifi: mvm: don't send a 6E related command when not supportedEmmanuel Grumbach1-1/+2
MCC_ALLOWED_AP_TYPE_CMD is related to 6E support. Do not send it if the device doesn't support 6E. Apparently, the firmware is mistakenly advertising support for this command even on AX201 which does not support 6E and then the firmware crashes. Fixes: 0d2fc8821a7d ("wifi: iwlwifi: nvm: parse the VLP/AFC bit from regulatory") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220804 Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260324113316.e171f0163f2a.I0c444d1f82d1773054e7ffc391ad49697d58f44e@changeid
2026-03-24wifi: iwlwifi: mld: Fix MLO scan timingPagadala Yesu Anjaneyulu7-8/+56
Calculate MLO scan start time based on actual scan start notification from firmware instead of recording time when scan command is sent. Currently, MLO scan start time was captured immediately after sending the scan command to firmware. However, the actual scan start time may differ due to the FW being busy with a previous scan. In that case, the link selection code will think that the MLO scan is too old, and will warn. To fix it, Implement start scan notification handling to capture the precise moment when firmware begins the scan operation. Fixes: 9324731b9985 ("wifi: iwlwifi: mld: avoid selecting bad links") Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260324113316.4c56b8bac533.I6e656d8cc30bb82c96aabadedd62bd67f4c46bf9@changeid
2026-03-24Merge tag 'linux-can-fixes-for-7.0-20260323' of ↵Paolo Abeni2-6/+27
git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2026-03-23 this is a pull request of 5 patches for net/main. The first patch is by me and adds missing error handling to the CAN netlink device configuration code. Wenyuan Li contributes a patch for the mcp251x drier to add missing error handling for power enabling in th open and resume functions. Oliver Hartkopp's patch adds missing atomic access in hot path for the CAN procfs statistics. A series by Ali Norouzi and Oliver Hartkopp fix a can-Out-of-Bounds Heap R/W in the can-gw protocol and a UAF in the CAN isotp protocol. linux-can-fixes-for-7.0-20260323 * tag 'linux-can-fixes-for-7.0-20260323' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() can: gw: fix OOB heap access in cgw_csum_crc8_rel() can: statistics: add missing atomic access in hot path can: mcp251x: add error handling for power enable in open and resume can: netlink: can_changelink(): add missing error handling to call can_ctrlmode_changelink() ==================== Link: https://patch.msgid.link/20260323103224.218099-1-mkl@pengutronix.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX pathDavid Carlier1-2/+2
cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor. In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is freed via k3_cppi_desc_pool_free() before the psdata pointer is used by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1]. This constitutes a use-after-free on every received packet that goes through the timestamp path. Defer the descriptor free until after all accesses through the psdata pointer are complete. For emac_rx_packet(), move the free into the requeue label so both early-exit and success paths free the descriptor after all accesses are done. For emac_rx_packet_zc(), move the free to the end of the loop body after emac_dispatch_skb_zc() (which calls emac_rx_timestamp()) has returned. Fixes: 46eeb90f03e0 ("net: ti: icssg-prueth: Use page_pool API for RX buffer allocation") Signed-off-by: David Carlier <devnexen@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260320174439.41080-1-devnexen@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24net: stmmac: elminate tbs_desc in stmmac_xmit()Russell King (Oracle)1-3/+2
There is no need to have a local variable for tbs_desc, we can do the conversion when calling stmmac_set_desc_tbs(). Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1w3d0b-0000000DfMD-2hrD@rmk-PC.armlinux.org.uk Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24net: stmmac: use first_desc for TBSRussell King (Oracle)1-1/+6
Rather than freshly getting a pointer for the TBS descriptor (because we want to access its enhanced fields) convert the existing first_desc basic descriptor to a pointer to the enhanced descriptor. Add a comment explaining why it is safe to convert from the basic descriptor pointer to the enhanced descriptor pointer. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1w3d0W-0000000DfM7-2BMA@rmk-PC.armlinux.org.uk Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> [pabeni@redhat.com: fixed comment typo] Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24net: stmmac: move stmmac_xmit() initial variable initRussell King (Oracle)1-4/+4
Move tx_q, first_tx and txq_stats just before their first use. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1w3d0R-0000000DfM1-1itN@rmk-PC.armlinux.org.uk Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24net: stmmac: move stmmac_xmit() first entry index codeRussell King (Oracle)1-4/+4
The handling of the first descriptor index/pointer is split around the checksum handling which makes no sense. Group this code together. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1w3d0M-0000000DfLv-1C6S@rmk-PC.armlinux.org.uk Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24net: stmmac: move first xmit descriptor SARC and TBS configRussell King (Oracle)1-10/+10
Move the first transmit descriptor's SARC and TBS configuration alongside the code which populates the first descriptor, which helps to keep all the code specific to that descriptor together. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1w3d0H-0000000DfLp-0gIx@rmk-PC.armlinux.org.uk Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24net: stmmac: move stmmac_xmit() skb head handlingRussell King (Oracle)1-33/+30
The skb head buffer handling is delayed in stmmac_xmit() until after the skb fragments have been populated into the descriptors. The reason is this code used to set the OWN bit on the first descriptor, which then allows the TX DMA to process the first and subsequent descriptors. However, as of commit 579a25a854d4 ("net: stmmac: Initial support for TBS") this is now separated, but the comments weren't updated. Move the code populating the first descriptor along side the jumbo code which also populates the first descriptor. This gives a consistent location where we populate the descriptor(s) for the SKB head. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1w3d0C-0000000DfLj-0BLb@rmk-PC.armlinux.org.uk Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24media: ov02a10, dw9768: Remove Dongchung's e-mailSakari Ailus2-2/+2
Dongchung's e-mail address returns a permanent error: The following message to <dongchun.zhu@mediatek.com> was undeliverable. The reason for the problem: 5.1.0 - Unknown address error 550-'Relaying mail to dongchun.zhu@mediatek.com is not allowed' Remove the address. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: subdev: Split v4l2_subdev_get_frame_desc_passthrough() into locked ↵Tomi Valkeinen1-20/+28
and unlocked The recently added v4l2_subdev_get_frame_desc_passthrough() can be used directly as an implementation for .get_frame_desc subdev op. However, in some cases the drivers may want to add some customizations, while the bulk of the work is still identical to what v4l2_subdev_get_frame_desc_passthrough() does. Current locking scheme makes this impossible to do properly. Split v4l2_subdev_get_frame_desc_passthrough() into two functions: __v4l2_subdev_get_frame_desc_passthrough(), which takes a locked subdev state as a parameter, instead of locking and getting the active state internally. Other than that, it does the same as v4l2_subdev_get_frame_desc_passthrough() used to do. v4l2_subdev_get_frame_desc_passthrough(), which locks the active state and calls __v4l2_subdev_get_frame_desc_passthrough(). In other words, v4l2_subdev_get_frame_desc_passthrough() works as before, but drivers can now alternatively add custom .get_frame_desc code and call v4l2_subdev_get_frame_desc_passthrough(). An example use case is with DS90UB953 serializer: in normal use the serializer passes through everything, but when test-pattern-generator (TPG) is used, an internal TPG source is used. After this commit, the UB953 get_frame_desc() can lock the state, look at the routing table to see if we're in normal or TPG mode, then either call __v4l2_subdev_get_frame_desc_passthrough() if in normal mode, or construct a TPG frame desc if in TPG mode. Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com> [Sakari Ailus: Rebase on an earlier remote source pad error code fix.] Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: subdev: Minor v4l2_subdev_get_frame_desc_passthrough() cleanupsTomi Valkeinen1-6/+4
Minor code cleanups, no functional change. Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: i2c: ov8856: parse and register V4L2 device tree propertiesAlexander Koskovich1-1/+12
Parse V4L2 device tree properties and register controls for them. Signed-off-by: Alexander Koskovich <akoskovich@pm.me> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: i2c: ov8856: free control handler on error in ov8856_init_controls()Alexander Koskovich1-2/+8
The control handler wasn't freed if adding controls failed, add an error exit label and convert the existing error return to use it. Fixes: 879347f0c258 ("media: ov8856: Add support for OV8856 sensor") Cc: stable@vger.kernel.org Signed-off-by: Alexander Koskovich <akoskovich@pm.me> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: v4l2-subdev: Fix error check in v4l2_subdev_get_frame_desc_passthrough()Chen Ni1-2/+2
Use IS_ERR() and PTR_ERR() to properly handle the error return from media_pad_remote_pad_unique(), which returns ERR_PTR() on failure but never NULL. The previous code only checked for NULL, leading to invalid pointer dereference. Detected by Smatch: drivers/media/v4l2-core/v4l2-subdev.c:2588 v4l2_subdev_get_frame_desc_passthrough() warn: 'remote_source_pad' is an error pointer or valid drivers/media/v4l2-core/v4l2-subdev.c:2595 v4l2_subdev_get_frame_desc_passthrough() error: 'remote_source_pad' dereferencing possible ERR_PTR() Fixes: a564839e630c ("media: subdev: Add v4l2_subdev_get_frame_desc_passthrough helper") Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Reviewed-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com> Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: i2c: imx355: Restrict data lanes to 4Richard Acayan1-0/+6
The IMX355 sensor driver currently supports having 4 data lanes. There can't be more or less, so check if the firmware specifies 4 lanes. Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com> Link: https://lore.kernel.org/r/aW3uFcT1zmiF4GUP@kekkonen.localdomain Signed-off-by: Richard Acayan <mailingradian@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: bcm2835-unicam: Fix RGB format / mbus code associationMaxime Ripard1-9/+32
The Unicam driver is a MIPI-CSI2 Receiver, that can capture RGB 4:4:4, YCbCr 4:2:2, and raw formats. RGB 4:4:4 is converted to the MIPI-CSI2 RGB888 video format, and associated to the MEDIA_BUS_FMT_RGB888_1X24 media bus code. However, V4L2_PIX_FMT_RGB24 is defined as having its color components in the R, G and B order, from left to right. MIPI-CSI2 however defines the RGB888 format with blue first, and that's what MEDIA_BUS_FMT_RGB888_1X24 defines too. This essentially means that the R and B will be swapped compared to what V4L2_PIX_FMT_RGB24 defines. The same situation occurs with V4L2_PIX_FMT_BGR24 being associated to MEDIA_BUS_FMT_BGR888_1X24. In order to fix the swapped components, we need to change the association of V4L2_PIX_FMT_BGR24 to MEDIA_BUS_FMT_RGB888_1X24, and of V4L2_PIX_FMT_RGB24 to MEDIA_BUS_FMT_BGR888_1X24. Since the media bus code is exposed to userspace, and validated by unicam's link_validate implementation, we need to explicitly accept (and warn) the old association still to preserve backward compatibility. Signed-off-by: Maxime Ripard <mripard@redhat.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: renesas: vin: Fix RAW8 (again)Tomi Valkeinen2-0/+34
Commit e7376745ad5c ("media: rcar-vin: Fix stride setting for RAW8 formats") removed dividing the stride by two for RAW8 formats. It is unclear how this was tested, but in any of the recent tests this does not seem to work and produces quite distorted images. However, reverting the patch fixes the issues only partially. VNIS_REG requires alignment to 16 bytes, and when dividing the stride by 2, in some cases we end up with a non-aligned stride, producing a tilted image. This issue has to be fixed in rvin_format_bytesperline() where we do the alignment for bytesperline. Adding back the stride division and increasing the alignment for RAW8 formats to 0x20 fixes the problems related to RAW8. Fixes: e7376745ad5c ("media: rcar-vin: Fix stride setting for RAW8 formats") Cc: stable@vger.kernel.org Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: renesas: vsp1: Fix NULL pointer deref on module unloadTomi Valkeinen1-2/+6
When unloading the module on gen 4, we hit a NULL pointer dereference. This is caused by the cleanup code calling vsp1_drm_cleanup() where it should be calling vsp1_vspx_cleanup(). Fix this by checking the IP version and calling the drm or vspx function accordingly, the same way as the init code does. Fixes: d06c1a9f348d ("media: vsp1: Add VSPX support") Cc: stable@vger.kernel.org Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: v4l2-fwnode: Return -EPROBE_DEFER on parsing NULL endpointsSakari Ailus1-1/+8
In general drivers get their firmware graph endpoints from system firmware, but on some systems this information is conveyed to drivers via software nodes. The software nodes may be instantiated only after the drivers are first probed, requiring drivers to explicitly issue -EPROBE_DEFER when endpoints aren't found. Instead of doing this in all (or at least most) drivers, make v4l2-fwnode endpoint parsing functions v4l2_fwnode_endpoint_parse() and v4l2_fwnode_endpoint_alloc_parse() return -EPROBE_DEFER when an endpoint is NULL. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24platform/x86: ISST: Correct locked bit widthSrinivas Pandruvada1-1/+1
SST-PP locked bit width is set to three bits. It should be only one bit. Use SST_PP_LOCK_WIDTH define instead of SST_PP_LEVEL_WIDTH. Fixes: ea009e4769fa ("platform/x86: ISST: Add SST-PP support via TPMI") Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260323153635.3263828-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-03-24team: fix header_ops type confusion with non-Ethernet portsJiayuan Chen1-1/+64
Similar to commit 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()") team has the same class of header_ops type confusion. For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops directly. When the team device later calls dev_hard_header() or dev_parse_header(), these callbacks can run with the team net_device instead of the real lower device, so netdev_priv(dev) is interpreted as the wrong private type and can crash. The syzbot report shows a crash in bond_header_create(), but the root cause is in team: the topology is gre -> bond -> team, and team calls the inherited header_ops with its own net_device instead of the lower device, so bond_header_create() receives a team device and interprets netdev_priv() as bonding private data, causing a type confusion crash. Fix this by introducing team header_ops wrappers for create/parse, selecting a team port under RCU, and calling the lower device callbacks with port->dev, so each callback always sees the correct net_device context. Also pass the selected lower device to the lower parse callback, so recursion is bounded in stacked non-Ethernet topologies and parse callbacks always run with the correct device context. Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") Reported-by: syzbot+3d8bc31c45e11450f24c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69b46af7.050a0220.36eb34.000e.GAE@google.com/T/ Cc: Jiayuan Chen <jiayuan.chen@linux.dev> Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com> Link: https://patch.msgid.link/20260320072139.134249-2-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24virtio-net: correct hdr_len handling for VIRTIO_NET_F_GUEST_HDRLENXuan Zhuo2-2/+6
The commit be50da3e9d4a ("net: virtio_net: implement exact header length guest feature") introduces support for the VIRTIO_NET_F_GUEST_HDRLEN feature in virtio-net. This feature requires virtio-net to set hdr_len to the actual header length of the packet when transmitting, the number of bytes from the start of the packet to the beginning of the transport-layer payload. However, in practice, hdr_len was being set using skb_headlen(skb), which is clearly incorrect. This commit fixes that issue. Fixes: be50da3e9d4a ("net: virtio_net: implement exact header length guest feature") Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com> Link: https://patch.msgid.link/20260320021818.111741-2-xuanzhuo@linux.alibaba.com Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24octeontx2-af: simplify rvu_debugfsYury Norov1-23/+5
The driver uses bitmap_print_to_pagebuf() to store human-readable bitmaps representations in a temporary buffers; and then feed seq_printf() with it. Switch to using seq_printf("%*pb") directly and drop intermediate buffer. Signed-off-by: Yury Norov <ynorov@nvidia.com> Link: https://patch.msgid.link/20260319201713.941956-2-ynorov@nvidia.com Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24amd-xgbe: add TX descriptor cleanup for link-downRaju Rangoju3-16/+108
Add intelligent TX descriptor cleanup mechanism to reclaim abandoned descriptors when the physical link goes down. When the link goes down while TX packets are in-flight, the hardware stops processing descriptors with the OWN bit still set. The current driver waits indefinitely for these descriptors to complete, which never happens. This causes: - TX ring exhaustion (no descriptors available for new packets) - Memory leaks (skbs never freed) - DMA mapping leaks (mappings never unmapped) - Network stack backpressure buildup Add force-cleanup mechanism in xgbe_tx_poll() that detects link-down state and reclaims abandoned descriptors. The helper functions and DMA optimizations support efficient TX shutdown: - xgbe_wait_for_dma_tx_complete(): Wait for DMA completion with link-down optimization - Restructure xgbe_disable_tx() for proper shutdown sequence Implementation: 1. Check link state at the start of tx_poll 2. If link is down, set force_cleanup flag 3. For descriptors that hardware hasn't completed (!tx_complete): - If force_cleanup: treat as completed and reclaim resources - If link up: break and wait for hardware (normal behavior) The cleanup process: - Frees skbs that will never be transmitted - Unmaps DMA mappings - Resets descriptors for reuse - Does NOT count as successful transmission (correct statistics) Benefits: - Prevents TX ring starvation - Eliminates memory and DMA mapping leaks - Enables fast link recovery when link comes back up - Critical for link aggregation failover scenarios Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com> Link: https://patch.msgid.link/20260319163251.1808611-4-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24amd-xgbe: optimize TX shutdown on link-downRaju Rangoju2-0/+27
Optimize the TX shutdown sequence when link goes down by skipping futile hardware wait operations and immediately stopping TX queues. Current behavior creates delays and resource issues during link-down: 1. xgbe_txq_prepare_tx_stop() waits up to XGBE_DMA_STOP_TIMEOUT for TX queues to drain, but when link is down, hardware will never complete the pending descriptors. This causes unnecessary delays during interface shutdown. 2. TX queues remain active after link-down, allowing the network stack to continue queuing packets that cannot be transmitted. This leads to resource buildup and complicates recovery. This patch adds two optimizations: Optimization 1: Skip TX queue drain when link is down In xgbe_txq_prepare_tx_stop(), detect link-down state and return immediately instead of waiting for hardware. Abandoned descriptors will be cleaned up by the force-cleanup mechanism (next patch). Optimization 2: Immediate TX queue stop on link-down In xgbe_phy_adjust_link(), call netif_tx_stop_all_queues() as soon as link-down is detected. Also wake TX queues on link-up to resume transmission. Benefits: - Faster interface shutdown (no pointless timeout waits) - Prevents packet queue buildup in network stack - Cleaner state management during link transitions - Enables orderly descriptor cleanup by NAPI poll Note: We do not call netdev_tx_reset_queue() on link-down because NAPI poll may still be running, which would trigger BQL assertions. BQL state is cleaned up naturally during descriptor reclamation. Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com> Link: https://patch.msgid.link/20260319163251.1808611-3-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24amd-xgbe: add adaptive link status pollingRaju Rangoju1-1/+23
Implement adaptive link status polling to enable fast link-down detection while conserving CPU resources during link-down periods. Currently, the driver polls link status at a fixed 1-second interval regardless of link state. This creates a trade-off: - Slow polling (1s): Misses rapid link state changes, causing delays - Fast polling: Wastes CPU when link is stable or down This enhancement introduces state-aware polling: When carrier is UP: Poll every 100ms to enable rapid link-down detection. This provides ~100-200ms response time to link failures, minimizing packet loss and enabling fast failover in link aggregation configurations. When carrier is DOWN: Poll every 1s to conserve CPU resources. Link-up detection is less time-critical since no traffic is flowing. Performance impact: - Link-down detection: 1000ms → 100-200ms (10x improvement) - CPU overhead when link up: 0.1% → 1% (acceptable for active links) - CPU overhead when link down: unchanged at 0.1% This is particularly valuable for: - Link aggregation deployments requiring sub-second failover - Environments with flaky links or cable issues - Applications sensitive to connection recovery time Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com> Link: https://patch.msgid.link/20260319163251.1808611-2-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-24vfio/xe: Notify PF about VF FLR in reset_preparePiotr Piórkowski1-0/+14
Hook into the PCI error handler reset_prepare() callback to notify the PF about an upcoming VF FLR before reset_done() is executed. This enables early FLR_PREPARE signaling and ensures that the PF is aware of the reset before the completion wait begins. Signed-off-by: Piotr Piórkowski <piotr.piorkowski@intel.com> Cc: Michał Winiarski <michal.winiarski@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Reviewed-by: Alex Williamson <alex@shazbot.org> Link: https://patch.msgid.link/20260309152449.910636-3-piotr.piorkowski@intel.com Signed-off-by: Michał Winiarski <michal.winiarski@intel.com>
generated by cgit v1.2.3 (git 2.39.0) at 2026-06-02 13:28:58 +0300