summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-03-17tg3: replace placeholder MAC address with device propertyPaul SAGE1-0/+11
On some systems (e.g. iMac 20,1 with BCM57766), the tg3 driver reads a default placeholder mac address (00:10:18:00:00:00) from the mailbox. The correct value on those systems are stored in the 'local-mac-address' property. This patch, detect the default value and tries to retrieve the correct address from the device_get_mac_address function instead. The patch has been tested on two different systems: - iMac 20,1 (BCM57766) model which use the local-mac-address property - iMac 13,2 (BCM57766) model which can use the mailbox, NVRAM or MAC control registers Tested-by: Rishon Jonathan R <mithicalaviator85@gmail.com> Co-developed-by: Vincent MORVAN <vinc@42.fr> Signed-off-by: Vincent MORVAN <vinc@42.fr> Signed-off-by: Paul SAGE <paul.sage@42.fr> Signed-off-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com> Reviewed-by: Michael Chan <michael.chan@broadcom.com> Link: https://patch.msgid.link/20260314215432.3589-1-atharvatiwarilinuxdev@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds checkTobi Gaertner1-2/+3
The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. Compile-tested only. Fixes: 0fa81b304a79 ("cdc_ncm: Implement the 32-bit version of NCM Transfer Block") Signed-off-by: Tobi Gaertner <tob.gaertner@me.com> Link: https://patch.msgid.link/20260314054640.2895026-3-tob.gaertner@me.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds checkTobi Gaertner1-2/+3
cdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE entries fit within the skb. The first check correctly accounts for ndpoffset: if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) > skb_in->len) but the second check omits it: if ((sizeof(struct usb_cdc_ncm_ndp16) + ret * (sizeof(struct usb_cdc_ncm_dpe16))) > skb_in->len) This validates the DPE array size against the total skb length as if the NDP were at offset 0, rather than at ndpoffset. When the NDP is placed near the end of the NTB (large wNdpIndex), the DPE entries can extend past the skb data buffer even though the check passes. cdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating the DPE array. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. Fixes: ff06ab13a4cc ("net: cdc_ncm: splitting rx_fixup for code reuse") Signed-off-by: Tobi Gaertner <tob.gaertner@me.com> Link: https://patch.msgid.link/20260314054640.2895026-2-tob.gaertner@me.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17net: macb: set default_an_inband to true for SGMIICharles Perry1-0/+6
Most platforms using GEM in SGMII mode use in-band autonegotiation because it is on by default in GEM's 1G PCS and is always on since commit e276e5e40e92 ("net: macb: Disable PCS auto-negotiation for SGMII fixed-link mode"). Leave it on if possible using the "default_an_inband" flag of "struct phylink_config" so that platforms that lack in-band autonegotiation configurability at the PHY do not break with commit 1338cfef1ff1 ("net: macb: fix SGMII with inband aneg disabled") which will turn off in-band autoneg for non hot pluggable PHYs. Once the majority of the PHY drivers that support SGMII have the ->config_inband() callback, this commit could be reverted so that non hot pluggable PHY use outband negotiation with macb, like its the case for other MACs. Fixes: 1338cfef1ff1 ("net: macb: fix SGMII with inband aneg disabled") Reported-by: Conor Dooley <conor.dooley@microchip.com> Closes: https://lore.kernel.org/r/20260304-nebulizer-rounding-40fbc81a2ba1@spud Signed-off-by: Charles Perry <charles.perry@microchip.com> Tested-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20260313142140.4040647-1-charles.perry@microchip.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17net: stmmac: move MSI data out of struct stmmac_privRussell King (Oracle)2-52/+81
Only three platforms supprt MSIs, which means having all the strings and interrupt arrays always allocated wastes space. None of this data is performance critical - this data is only used when requesting and releasing the MSI interrupts. Move the MSI data out of struct stmmac_priv into its own separately allocated structure, and move its initialisation to a separate function. This removes 768 bytes from struct stmmac_priv. Link: https://lore.kernel.org/r/aYtq4ypxXTvn_Is6@shell.armlinux.org.uk Reviewed-by: Florian Bezdeka <florian.bezdeka@siemens.com> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1w113e-0000000DDwc-2oRv@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17stmmac: s32: enable support for Multi-IRQ modeJan Petrous (OSS)1-1/+35
Based on previous changes in platform driver, the vendor glue driver can enable Multi-IRQ mode, if needed. To get enabled Multi-IRQ mode for dwmac-s32, the driver checks: 1) property of 'snps,mtl-xx-config' subnode defines 'snps,xx-queues-to-use' bigger then one, ie: ethernet@4033c000 { compatible = "nxp,s32g2-dwmac"; ... snps,mtl-rx-config = <&mtl_rx_setup>; ... mtl_rx_setup: rx-queues-config { snps,rx-queues-to-use = <2>; }; 2) queue based IRQs are set, ie: ethernet@4033c000 { compatible = "nxp,s32g2-dwmac"; ... interrupts = <GIC_SPI 57 IRQ_TYPE_LEVEL_HIGH>, /* CHN 0: tx, rx */ <GIC_SPI 58 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 59 IRQ_TYPE_LEVEL_HIGH>, /* CHN 1: tx, rx */ <GIC_SPI 60 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 61 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "macirq", "tx-queue-0", "rx-queue-0", "tx-queue-1", "rx-queue-1"; If those prerequisites are met, the driver switches to Multi-IRQ mode, using per-queue IRQs for rx/tx data pathr: [ 1.387045] s32-dwmac 4033c000.ethernet: Multi-IRQ mode (per queue IRQs) selected Now the driver owns all queues IRQs: root@s32g399aevb3:~# grep eth /proc/interrupts 29: 0 0 0 0 0 0 0 0 GICv3 89 Level eth0:mac 30: 0 0 0 0 0 0 0 0 GICv3 91 Level eth0:rx-0 31: 0 0 0 0 0 0 0 0 GICv3 93 Level eth0:rx-1 32: 0 0 0 0 0 0 0 0 GICv3 95 Level eth0:rx-2 33: 0 0 0 0 0 0 0 0 GICv3 97 Level eth0:rx-3 34: 0 0 0 0 0 0 0 0 GICv3 99 Level eth0:rx-4 35: 0 0 0 0 0 0 0 0 GICv3 90 Level eth0:tx-0 36: 0 0 0 0 0 0 0 0 GICv3 92 Level eth0:tx-1 37: 0 0 0 0 0 0 0 0 GICv3 94 Level eth0:tx-2 38: 0 0 0 0 0 0 0 0 GICv3 96 Level eth0:tx-3 39: 0 0 0 0 0 0 0 0 GICv3 98 Level eth0:tx-4 Otherwise, if one of the prerequisite don't met, the driver continue with MAC IRQ mode: [ 1.387045] s32-dwmac 4033c000.ethernet: MAC IRQ mode selected And only MAC IRQ will be attached: root@s32g399aevb3:~# grep eth /proc/interrupts 29: 0 0 0 0 0 0 0 0 GICv3 89 Level eth0:mac What represents the original MAC IRQ mode and is fully backward compatible. Reviewed-by: Matthias Brugger <mbrugger@suse.com> Signed-off-by: Jan Petrous (OSS) <jan.petrous@oss.nxp.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20260313-dwmac_multi_irq-v12-4-b5c9d0aa13d6@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17net: stmmac: platform: read channels irqJan Petrous (OSS)1-1/+56
Read IRQ resources for all rx/tx channels, to allow Multi-IRQ mode for platform glue drivers. Reviewed-by: Matthias Brugger <mbrugger@suse.com> Signed-off-by: Jan Petrous (OSS) <jan.petrous@oss.nxp.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20260313-dwmac_multi_irq-v12-1-b5c9d0aa13d6@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17net: airoha: Remove airoha_dev_stop() in airoha_remove()Lorenzo Bianconi1-1/+0
Do not run airoha_dev_stop routine explicitly in airoha_remove() since ndo_stop() callback is already executed by unregister_netdev() in __dev_close_many routine if necessary and, doing so, we will end up causing an underflow in the qdma users atomic counters. Rely on networking subsystem to stop the device removing the airoha_eth module. Fixes: 23020f0493270 ("net: airoha: Introduce ethernet support for EN7581 SoC") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260313-airoha-remove-ndo_stop-remove-net-v2-1-67542c3ceeca@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17bonding: prevent potential infinite loop in bond_header_parse()Eric Dumazet2-5/+8
bond_header_parse() can loop if a stack of two bonding devices is setup, because skb->dev always points to the hierarchy top. Add new "const struct net_device *dev" parameter to (struct header_ops)->parse() method to make sure the recursion is bounded, and that the final leaf parse method is called. Fixes: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()") Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Jiayuan Chen <jiayuan.chen@shopee.com> Tested-by: Jiayuan Chen <jiayuan.chen@shopee.com> Cc: Jay Vosburgh <jv@jvosburgh.net> Cc: Andrew Lunn <andrew+netdev@lunn.ch> Link: https://patch.msgid.link/20260315104152.1436867-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17net: ti: icssg-prueth: Add HSR multicast FDB port membership managementMD Danish Anwar1-16/+233
In HSR offload mode, multicast addresses can be added via HSR master (hsr0) or directly to slave ports (eth1/eth2). The FDB must track port membership: P0 (0x1) for HSR master, P1 (0x2) for slave port 1, and P2 (0x4) for slave port 2. When the same address is added from multiple paths, memberships must accumulate. Implement a hybrid approach using __dev_mc_sync() callbacks to track basic add/delete operations, checking netdev_hw_addr->synced to distinguish HSR-synced addresses from direct additions. Post-process to handle overlapping memberships by checking refcount: - refcount=2 with synced=1: HSR only (P0) - refcount>=3 with synced=1: HSR + direct (P0|P1/P2) - synced=0 with P0 set: HSR removed, clean up orphaned P0 On add operations, accumulate new membership with existing ports. On delete operations, remove only the specific port and clean up orphaned P0 bits if needed. Add error handling for icssg_fdb_lookup() which can return negative error codes (e.g., -ETIMEDOUT). On lookup failure in add/delete path, default to no existing membership. In the post-processing path, skip the address update to avoid corrupting FDB entries with garbage values. VLAN Interface Handling: Add support for multicast addresses added to VLAN interfaces on the HSR master (e.g., hsr0.7). These addresses require P0 (HSR master) bit to be set along with the port bits, since VLAN-tagged packets use separate FDB entries per VLAN ID. Without P0, the HSR master would not receive multicast packets on VLAN interfaces. Track whether the add/del operation came from a VLAN interface path and set P0 when in HSR offload mode with VLAN interfaces. Update orphaned P0 cleanup logic to preserve P0 for VLAN interfaces. Signed-off-by: MD Danish Anwar <danishanwar@ti.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260311082923.2962937-1-danishanwar@ti.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17virtio_net: add page_pool support for buffer allocationVishwanath Seshagiri2-247/+251
Use page_pool for RX buffer allocation in mergeable and small buffer modes to enable page recycling and avoid repeated page allocator calls. skb_mark_for_recycle() enables page reuse in the network stack. Big packets mode is unchanged because it uses page->private for linked list chaining of multiple pages per buffer, which conflicts with page_pool's internal use of page->private. Implement conditional DMA premapping using virtqueue_dma_dev(): - When non-NULL (vhost, virtio-pci): use PP_FLAG_DMA_MAP with page_pool handling DMA mapping, submit via virtqueue_add_inbuf_premapped() - When NULL (VDUSE, direct physical): page_pool handles allocation only, submit via virtqueue_add_inbuf_ctx() This preserves the DMA premapping optimization from commit 31f3cd4e5756b ("virtio-net: rq submits premapped per-buffer") while adding page_pool support as a prerequisite for future zero-copy features (devmem TCP, io_uring ZCRX). Page pools are created in probe and destroyed in remove (not open/close), following existing driver behavior where RX buffers remain in virtqueues across interface state changes. Signed-off-by: Vishwanath Seshagiri <vishs@meta.com> Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Link: https://patch.msgid.link/20260310183107.2822016-1-vishs@meta.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabledSmita Koralahalli1-16/+9
Check the global CXL_HDM_DECODER_ENABLE bit instead of looping over per-decoder COMMITTED bits to determine whether to fall back to DVSEC range emulation. When the HDM decoder capability is globally enabled, ignore DVSEC range registers regardless of individual decoder commit state. should_emulate_decoders() currently loops over per-decoder COMMITTED bits, which leads to an incorrect DVSEC fallback when those bits are zero. One way to trigger this is to destroy a region and bounce the memdev: cxl disable-region region0 cxl destroy-region region0 cxl disable-memdev mem0 cxl enable-memdev mem0 Region teardown zeroes the HDM decoder registers including the committed bits. The subsequent memdev re-probe finds uncommitted decoders and falls back to DVSEC emulation, even though HDM remains globally enabled. Observed failures: should_emulate_decoders: cxl_port endpoint6: decoder6.0: committed: 0 base: 0x0_00000000 size: 0x0_00000000 devm_cxl_setup_hdm: cxl_port endpoint6: Fallback map 1 range register .. devm_cxl_add_region: cxl_acpi ACPI0017:00: decoder0.0: created region0 __construct_region: cxl_pci 0000:e1:00.0: mem1:decoder6.0: __construct_region region0 res: [mem 0x850000000-0x284fffffff flags 0x200] iw: 1 ig: 4096 cxl region0: pci0000:e0:port1 cxl_port_setup_targets expected iw: 1 ig: 4096 .. cxl region0: pci0000:e0:port1 cxl_port_setup_targets got iw: 1 ig: 256 state: disabled .. cxl_port endpoint6: failed to attach decoder6.0 to region0: -6 .. devm_cxl_add_region: cxl_acpi ACPI0017:00: decoder0.0: created region4 alloc_hpa: cxl region4: HPA allocation error (-34) .. Fixes: 52cc48ad2a76 ("cxl/hdm: Limit emulation to the number of range registers") Signed-off-by: Smita Koralahalli <Smita.KoralahalliChannabasappa@amd.com> Reviewed-by: Dan Williams <dan.j.williams@intel.com> Link: https://patch.msgid.link/20260316201950.224567-1-Smita.KoralahalliChannabasappa@amd.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-03-17cxl/region: Factor out interleave granularity setupAlejandro Lucero1-12/+24
Region creation based on Type3 devices can be triggered from user space allowing memory combination through interleaving. In preparation for kernel driven region creation, that is Type2 drivers triggering region creation backed with its advertised CXL memory, factor out a common helper from the user-sysfs region setup for interleave granularity. Signed-off-by: Alejandro Lucero <alucerop@amd.com> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Tested-by: Gregory Price <gourry@gourry.net> Reviewed-by: Alison Schofield <alison.schofield@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Link: https://patch.msgid.link/20260228173603.1125109-4-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-03-17cxl/region: Factor out interleave ways setupAlejandro Lucero1-15/+26
Region creation based on Type3 devices can be triggered from user space allowing memory combination through interleaving. In preparation for kernel driven region creation, that is Type2 drivers triggering region creation backed with its advertised CXL memory, factor out a common helper from the user-sysfs region setup for interleave ways. Signed-off-by: Alejandro Lucero <alucerop@amd.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Gregory Price <gourry@gourry.net> Tested-by: Gregory Price <gourry@gourry.net> Reviewed-by: Alison Schofield <alison.schofield@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Link: https://patch.msgid.link/20260228173603.1125109-3-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-03-17cxl: Make region type based on endpoint typeAlejandro Lucero1-4/+6
Current code is expecting Type3 or CXL_DECODER_HOSTONLYMEM devices only. Support for Type2 implies region type needs to be based on the endpoint type HDM-D[B] instead. Signed-off-by: Alejandro Lucero <alucerop@amd.com> Reviewed-by: Zhi Wang <zhiw@nvidia.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Ben Cheatham <benjamin.cheatham@amd.com> Reviewed-by: Alison Schofield <alison.schofield@intel.com> Reviewed-by: Davidlohr Bueso <daves@stgolabs.net> Reviewed-by: Gregory Price <gourry@gourry.net> Tested-by: Gregory Price <gourry@gourry.net> Reviewed-by: Davidlohr Bueso <dave@stgolabs.net> Link: https://patch.msgid.link/20260228173603.1125109-2-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-03-17cxl/pci: Remove redundant cxl_pci_find_port() callGregory Price1-5/+0
Remove the redundant port lookup from cxl_rcrb_get_comp_regs() and use the dport parameter directly. The caller has already validated the port is non-NULL before invoking this function, and dport is given as a param. This is simpler than getting dport in the callee and return the pointer to the caller what would require more changes. Signed-off-by: Gregory Price <gourry@gourry.net> Reviewed-by: Alejandro Lucero <alucerop@amd.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Reviewed-by: Davidlohr Bueso <dave@stgolabs.net> Link: https://patch.msgid.link/20260306164741.3796372-5-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-03-17cxl: Move pci generic code from cxl_pci to core/cxl_pciAlejandro Lucero6-73/+77
Inside cxl/core/pci.c there are helpers for CXL PCIe initialization meanwhile cxl/pci_drv.c implements the functionality for a Type3 device initialization. In preparation for type2 support, move helper functions from cxl/pci.c to cxl/core/pci.c in order to be exported and used by type2 drivers. [ dj: Clarified subject. ] Signed-off-by: Alejandro Lucero <alucerop@amd.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Gregory Price <gourry@gourry.net> Link: https://patch.msgid.link/20260306164741.3796372-4-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-03-17cxl: export internal structs for external Type2 driversAlejandro Lucero2-210/+1
In preparation for type2 support, move structs and functions a type2 driver will need to access to into a new shared header file. Differentiate between public and private data to be preserved by type2 drivers. Signed-off-by: Alejandro Lucero <alucerop@amd.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Tested-by: Alison Schofield <alison.schofield@intel.com> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Link: https://patch.msgid.link/20260306164741.3796372-3-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-03-17cxl: support Type2 when initializing cxl_dev_stateAlejandro Lucero4-15/+69
In preparation for type2 drivers add function and macro for differentiating CXL memory expanders (type 3) from CXL device accelerators (type 2) helping drivers built from public headers to embed struct cxl_dev_state inside a private struct. Update type3 driver for using this same initialization. Signed-off-by: Alejandro Lucero <alucerop@amd.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Alison Schofield <alison.schofield@intel.com> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Link: https://patch.msgid.link/20260306164741.3796372-2-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-03-17PCI/pwrctrl: Create pwrctrl devices only for PCI device nodesManivannan Sadhasivam1-2/+9
A PCI host bridge node can have non-PCI child nodes (OPP tables, USB hub, etc.) as well as PCI device child nodes. Ensure that pwrctrl devices are only created for PCI device nodes by checking for the 'pci' prefix in the compatible property. Fixes: 4c4132489201 ("PCI/pwrctrl: Add APIs to create, destroy pwrctrl devices") Reported-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com> Closes: https://lore.kernel.org/all/20260212-rb3gen2-upd-gl3590-v1-1-18fb04bb32b0@oss.qualcomm.com Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260223-pwrctrl-fixes-7-0-v2-2-97566dfb1809@oss.qualcomm.com
2026-03-17PCI/pwrctrl: Ensure that remote endpoint node parent has supply requirementManivannan Sadhasivam1-13/+34
If OF graph is used in the PCI device node, the pwrctrl core creates a pwrctrl device even if the remote endpoint doesn't have power supply requirements. Since the device doesn't have any power supply requirements, there was no pwrctrl driver to probe, leading to PCI controller driver probe deferral as it waits for all pwrctrl drivers to probe before starting bus scan. This issue happens with Qcom ath12k devices with WSI interface attached to the Qcom IPQ platforms. Fix this issue by checking for the existence of at least one power supply property in the remote endpoint parent node. To consolidate all the checks, create a new helper pci_pwrctrl_is_required() and move all the checks there. Fixes: 9db826206f9b ("PCI/pwrctrl: Create pwrctrl device if graph port is found") Reported-by: Raj Kumar Bhagat <raj.bhagat@oss.qualcomm.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Raj Kumar Bhagat <raj.bhagat@oss.qualcomm.com> Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://patch.msgid.link/20260223-pwrctrl-fixes-7-0-v2-1-97566dfb1809@oss.qualcomm.com
2026-03-17nvme: remove nvme_dev_uring_cmd() IO_URING_F_IOPOLL checkCaleb Sander Mateos1-4/+0
nvme_dev_uring_cmd() is part of struct file_operations nvme_dev_fops, which doesn't implement ->uring_cmd_iopoll(). So it won't be called with issue_flags that include IO_URING_F_IOPOLL. Drop the unnecessary IO_URING_F_IOPOLL check in nvme_dev_uring_cmd(). Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Reviewed-by: Kanchan Joshi <joshi.k@samsung.com> Reviewed-by: Anuj Gupta <anuj20.g@samsung.com> Link: https://patch.msgid.link/20260302172914.2488599-6-csander@purestorage.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-03-17PCI/DPC: Hold pci_dev reference during error recoverySizhe Liu1-0/+2
The AER and EDR error handling paths hold a reference on the pci_dev during recovery. Hold a reference during the DPC recovery path as well. Signed-off-by: Sizhe Liu <liusizhe5@huawei.com> [bhelgaas: split to separate patch] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> https://patch.msgid.link/20260214081130.1878424-1-liusizhe5@huawei.com
2026-03-16net/mlx5: Expose MLX5_UMR_ALIGN definitionTariq Toukan1-1/+0
Expose HW constant value in a shared header, to be used by core/EN drivers. Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260309093435.1850724-10-tariqt@nvidia.com Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-03-16{net/RDMA}/mlx5: Add LAG demux table API and vport demux rulesShay Drory8-24/+287
Downstream patches will introduce SW-only LAG (e.g. shared_fdb without HW LAG). In this mode the firmware cannot create the LAG demux table, but vport demuxing is still required. Move LAG demux flow-table ownership to the LAG layer and introduce APIs to init/cleanup the demux table and add/delete per-vport rules. Adjust the RDMA driver to use the new APIs. In this mode, the LAG layer will create a flow group that matches vport metadata. Vports that are not native to the LAG master eswitch add the demux rule during IB representor load and remove it on unload. The demux rule forward traffic from said vports to their native eswitch manager via a new dest type - MLX5_FLOW_DESTINATION_TYPE_VHCA_RX. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260309093435.1850724-9-tariqt@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-03-16net/mlx5: Add VHCA RX flow destination support for FW steeringShay Drory3-2/+12
Introduce MLX5_FLOW_DESTINATION_TYPE_VHCA_RX as a new flow steering destination type. Wire the new destination through flow steering command setup by mapping it to MLX5_IFC_FLOW_DESTINATION_TYPE_VHCA_RX and passing the vhca id, extend forward-destination validation to accept it, and teach the flow steering tracepoint formatter to print rx_vhca_id. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260309093435.1850724-8-tariqt@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-03-16net/mlx5: LAG, replace mlx5_get_dev_index with LAG sequence numberShay Drory3-5/+42
Introduce mlx5_lag_get_dev_seq() which returns a device's sequence number within the LAG: master is always 0, remaining devices numbered sequentially. This provides a stable index for peer flow tracking and vport ordering without depending on native_port_num. Replace mlx5_get_dev_index() usage in en_tc.c (peer flow array indexing) and ib_rep.c (vport index ordering) with the new API. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260309093435.1850724-7-tariqt@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-03-16net/mlx5: E-switch, modify peer miss rule index to vhca_idShay Drory2-12/+10
Replace the fixed-size array peer_miss_rules[MLX5_MAX_PORTS], indexed by physical function index, with an xarray indexed by vhca_id. This decouples peer_miss_rules from mlx5_get_dev_index(), removing the dependency on a PF-derived index and the arbitrary MLX5_MAX_PORTS bounds check. Using vhca_id as the key simplifies insertion/removal logic and scales better across multi-peer topologies. Initialize and destroy the xarray alongside the existing esw->paired xarray in mlx5_esw_offloads_devcom_init/cleanup respectively. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260309093435.1850724-6-tariqt@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-03-16net/mlx5: LAG, use xa_alloc to manage LAG device indicesShay Drory4-56/+230
Replace the use of mlx5_get_dev_index() for xarray indexing with xa_alloc() to dynamically allocate indices. This decouples the LAG xarray index from the physical device index. Update mlx5_ldev_add_netdev/remove_mdev to find entries by dev pointer and replace mlx5_lag_get_dev_index_by_seq(ldev, MLX5_LAG_P1) calls with mlx5_lag_get_master_idx() where appropriate. No functional changes intended Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260309093435.1850724-5-tariqt@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-03-16net/mlx5: LAG, replace pf array with xarrayShay Drory6-120/+243
Replace the fixed-size array with a dynamic xarray. This commit changes: - Adds mlx5_lag_pf() helper for consistent xarray access - Converts all direct pf[] accesses to use the new helper/macro - Dynamically allocates lag_func entries via xa_store/xa_load No functional changes intended. This prepares the LAG infrastructure for future flexibility in device indexing. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260309093435.1850724-4-tariqt@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-03-16net/mlx5: Add silent mode set/query and VHCA RX IFC bitsShay Drory2-2/+2
Update the mlx5 IFC headers with newly defined capability and command-layout bits: - Add silent_mode_query and rename silent_mode to silent_mode_set cap fields. - Add forward_vhca_rx and MLX5_IFC_FLOW_DESTINATION_TYPE_VHCA_RX. - Expose silent mode fields in the L2 table query command structures. Update the SD support check to use the new capability name (silent_mode_set) to match the updated IFC definition. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260309093435.1850724-3-tariqt@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-03-16accel/amdxdna: Add debug prints for command submissionLizhi Hou1-5/+29
Add debug prints to help diagnose issues with incoming command submissions. Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260316175642.1451749-1-lizhi.hou@amd.com
2026-03-16vfio: replace vfio->class with a const struct classJori Koolstra1-12/+11
The class_create() call has been deprecated in favor of class_register() as the driver core now allows for a struct class to be in read-only memory. Replace vfio->class with a const struct class and drop the class_create() call. Compile tested and found no errors/warns in dmesg after enabling VFIO_GROUP. Link: https://lore.kernel.org/all/2023040244-duffel-pushpin-f738@gregkh/ Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl> Link: https://lore.kernel.org/r/20260306190628.259203-1-jkoolstra@xs4all.nl Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-03-16PM: runtime: Fix a race condition related to device removalBart Van Assche1-0/+1
The following code in pm_runtime_work() may dereference the dev->parent pointer after the parent device has been freed: /* Maybe the parent is now able to suspend. */ if (parent && !parent->power.ignore_children) { spin_unlock(&dev->power.lock); spin_lock(&parent->power.lock); rpm_idle(parent, RPM_ASYNC); spin_unlock(&parent->power.lock); spin_lock(&dev->power.lock); } Fix this by inserting a flush_work() call in pm_runtime_remove(). Without this patch blktest block/001 triggers the following complaint sporadically: BUG: KASAN: slab-use-after-free in lock_acquire+0x70/0x160 Read of size 1 at addr ffff88812bef7198 by task kworker/u553:1/3081 Workqueue: pm pm_runtime_work Call Trace: <TASK> dump_stack_lvl+0x61/0x80 print_address_description.constprop.0+0x8b/0x310 print_report+0xfd/0x1d7 kasan_report+0xd8/0x1d0 __kasan_check_byte+0x42/0x60 lock_acquire.part.0+0x38/0x230 lock_acquire+0x70/0x160 _raw_spin_lock+0x36/0x50 rpm_suspend+0xc6a/0xfe0 rpm_idle+0x578/0x770 pm_runtime_work+0xee/0x120 process_one_work+0xde3/0x1410 worker_thread+0x5eb/0xfe0 kthread+0x37b/0x480 ret_from_fork+0x6cb/0x920 ret_from_fork_asm+0x11/0x20 </TASK> Allocated by task 4314: kasan_save_stack+0x2a/0x50 kasan_save_track+0x18/0x40 kasan_save_alloc_info+0x3d/0x50 __kasan_kmalloc+0xa0/0xb0 __kmalloc_noprof+0x311/0x990 scsi_alloc_target+0x122/0xb60 [scsi_mod] __scsi_scan_target+0x101/0x460 [scsi_mod] scsi_scan_channel+0x179/0x1c0 [scsi_mod] scsi_scan_host_selected+0x259/0x2d0 [scsi_mod] store_scan+0x2d2/0x390 [scsi_mod] dev_attr_store+0x43/0x80 sysfs_kf_write+0xde/0x140 kernfs_fop_write_iter+0x3ef/0x670 vfs_write+0x506/0x1470 ksys_write+0xfd/0x230 __x64_sys_write+0x76/0xc0 x64_sys_call+0x213/0x1810 do_syscall_64+0xee/0xfc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 4314: kasan_save_stack+0x2a/0x50 kasan_save_track+0x18/0x40 kasan_save_free_info+0x3f/0x50 __kasan_slab_free+0x67/0x80 kfree+0x225/0x6c0 scsi_target_dev_release+0x3d/0x60 [scsi_mod] device_release+0xa3/0x220 kobject_cleanup+0x105/0x3a0 kobject_put+0x72/0xd0 put_device+0x17/0x20 scsi_device_dev_release+0xacf/0x12c0 [scsi_mod] device_release+0xa3/0x220 kobject_cleanup+0x105/0x3a0 kobject_put+0x72/0xd0 put_device+0x17/0x20 scsi_device_put+0x7f/0xc0 [scsi_mod] sdev_store_delete+0xa5/0x120 [scsi_mod] dev_attr_store+0x43/0x80 sysfs_kf_write+0xde/0x140 kernfs_fop_write_iter+0x3ef/0x670 vfs_write+0x506/0x1470 ksys_write+0xfd/0x230 __x64_sys_write+0x76/0xc0 x64_sys_call+0x213/0x1810 Reported-by: Ming Lei <ming.lei@redhat.com> Closes: https://lore.kernel.org/all/ZxdNvLNI8QaOfD2d@fedora/ Reported-by: syzbot+6c905ab800f20cf4086c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68c13942.050a0220.2ff435.000b.GAE@google.com/ Fixes: 5e928f77a09a ("PM: Introduce core framework for run-time PM of I/O devices (rev. 17)") Signed-off-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260312182720.2776083-1-bvanassche@acm.org Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-03-16spi: controller registration fixesMark Brown392-2502/+4193
Johan Hovold <johan@kernel.org> says: This series fixes a few issues related to controller registration found through inspection.
2026-03-16spi: fix misleading controller deregistration kernel-docJohan Hovold1-2/+4
The controller reference count is not decremented on deregistration if the controller has been allocated using devm_spi_alloc_host/target(). Amend the kernel-doc for devm_spi_register_controller() and spi_unregister_controller() so that it reflects this (more recent) behaviour. Fixes: 5e844cc37a5c ("spi: Introduce device-managed SPI controller allocation") Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260312151817.32100-6-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-16spi: fix misleading controller registration kernel-docJohan Hovold1-2/+2
The controller reference count is not decremented on registration failures (and has not been for a very long time) contrary to what the outdated kernel-doc says. Drop the entire sentence about return values which are now documented in the Return section. Fixes: b885244eb262 ("[PATCH] spi: add spi_driver to SPI framework") Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260312151817.32100-5-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-16spi: drop unused devres statistics allocationJohan Hovold1-15/+12
Drop the now unused device managed per-cpu statistics allocation. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260312151817.32100-4-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-16spi: fix statistics allocationJohan Hovold1-9/+8
The controller per-cpu statistics is not allocated until after the controller has been registered with driver core, which leaves a window where accessing the sysfs attributes can trigger a NULL-pointer dereference. Fix this by moving the statistics allocation to controller allocation while tying its lifetime to that of the controller (rather than using implicit devres). Fixes: 6598b91b5ac3 ("spi: spi.c: Convert statistics to per-cpu u64_stats_t") Cc: stable@vger.kernel.org # 6.0 Cc: David Jander <david@protonic.nl> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260312151817.32100-3-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-16spi: fix use-after-free on controller registration failureJohan Hovold1-4/+4
Make sure to deregister from driver core also in the unlikely event that per-cpu statistics allocation fails during controller registration to avoid use-after-free (of driver resources) and unclocked register accesses. Fixes: 6598b91b5ac3 ("spi: spi.c: Convert statistics to per-cpu u64_stats_t") Cc: stable@vger.kernel.org # 6.0 Cc: David Jander <david@protonic.nl> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260312151817.32100-2-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-16media: cx231xx: add USB ID 2040:8360 for Hauppauge WinTV-HVR-935Hans Verkuil1-0/+2
The Hauppauge WinTV-HVR-935 HD stick is supported as 2040:b151 (CX231XX_BOARD_HAUPPAUGE_935C). Some units report USB id 2040:8360 with product string "HVR-935 Audio" and are not bound by cx231xx, so no DVB adapter is created. Please consider adding 2040:8360 to the cx231xx_id_table with the same driver_info as 0xb151 so these devices work without out-of-tree patches. How the ID was obtained (Debian, kernel 6.1.0-40-amd64): $ lsusb -d 2040:8360 Bus 001 Device 006: ID 2040:8360 Hauppauge HVR-935 Audio $ lsusb -t | grep -A3 "Port 3" |__ Port 3: Dev 6, If 2, Class=Audio, Driver=snd-usb-audio, 480M |__ Port 3: Dev 6, If 0, Class=Vendor Specific Class, Driver=, 480M |__ Port 3: Dev 6, If 1, Class=Audio, Driver=snd-usb-audio, 480M Interface 0 (Vendor Specific) has no driver; the stock cx231xx module has no 2040:8360 in its alias table. Reported-by: Lucian Onicescu <lucian.onicescu@gmail.com> Closes: https://lore.kernel.org/linux-media/CALbYB1O79OnqKMF--HWVx-nuKtYKJbE+Ux=yK_45HDb4oujQyA@mail.gmail.com/ Suggested-by: Lucian Onicescu <lucian.onicescu@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-16media: saa7164: add ioremap return checks and cleanupsWang Jun1-12/+35
Add checks for ioremap return values in saa7164_dev_setup(). If ioremap for BAR0 or BAR2 fails, release the already allocated PCI memory regions, remove the device from the global list, decrement the device count, and return -ENODEV. This prevents potential null pointer dereferences and ensures proper cleanup on memory mapping failures. Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon") Cc: stable@vger.kernel.org Signed-off-by: Wang Jun <1742789905@qq.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-16ACPI: NUMA: Only parse CFMWS at boot when CXL_ACPI is onKai Huang1-2/+5
On CXL platforms, the Static Resource Affinity Table (SRAT) may not cover memory affinity information for all the CXL memory regions. Since each CXL memory region is enumerated via a CXL Fixed Memory Window Structure (CFMWS), during early boot the kernel parses the CFMWS tables to find all CXL memory regions and sets a NUMA node for each of them. This memory affinity information of CXL memory regions is later used by the CXL ACPI driver. The CFMWS table doesn't provide the memory affinity information either. Currently the kernel assigns a 'faked' NUMA node for each CXL memory region, starting from the next node of the highest node that is enumerated via the SRAT. This can potentially increase the maximum NUMA node ID of the platform ('nr_node_ids') a lot. E.g., on a GNR platform with 4 NUMA nodes and 18 CFMWS tables, this bumps the 'nr_node_ids' to 22. Increasing the 'nr_node_ids' has side effects. For instance, it is widely used by the kernel for "highest possible NUMA node" based memory allocations. It also impacts userspace ABIs, e.g., some NUMA memory related system calls such as 'get_mempolicy' which requires 'maxnode' not being smaller than the 'nr_node_ids'. Currently parsing CFMWS tables and assigning faked NUMA node at boot is done unconditionally. However, if the CXL ACPI driver is not enabled, there will be no user of such memory affinity information of CXL memory regions. Change to only parsing the CFMWS tables at boot when CXL_ACPI is enabled in Kconfig to avoid the unnecessary cost of bumping up 'nr_node_ids'. E.g., on the aforementioned GNR platform, the "Slab" in /proc/meminfo is reduced with this change (when CXL_ACPI is off): w/ this change w/o Slab 900488 kB 923660 kB Signed-off-by: Kai Huang <kai.huang@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Alison Schofield <alison.schofield@intel.com> Link: https://patch.msgid.link/20260308222313.14014-1-kai.huang@intel.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-03-16drm/xe: Skip adding PRL entry to NULL VMABrian Nguyen1-0/+6
NULL VMAs have no corresponding PTE, so skip adding a PRL entry to avoid an unnecessary PRL abort during unbind. Signed-off-by: Brian Nguyen <brian3.nguyen@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260305171546.67691-8-brian3.nguyen@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-03-16drm/xe: Move page reclaim done_handler to own funcBrian Nguyen3-15/+31
Originally, page reclamation is handled by the same fence as tlb invalidation and uses its seqno, so there was no reason to separate out the handlers. However in hindsight, for readability, and possible future changes, it seems more beneficial to move this all out to its own function. Signed-off-by: Brian Nguyen <brian3.nguyen@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com> Reviewed-by: Stuart Summers <stuart.summers@intel.com> Link: https://patch.msgid.link/20260305171546.67691-7-brian3.nguyen@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-03-16drm/xe: Skip over non leaf pte for PRL generationBrian Nguyen1-9/+29
The check using xe_child->base.children was insufficient in determining if a pte was a leaf node. So explicitly skip over every non-leaf pt and conditionally abort if there is a scenario where a non-leaf pt is interleaved between leaf pt, which results in the page walker skipping over some leaf pt. Note that the behavior being targeted for abort is PD[0] = 2M PTE PD[1] = PT -> 512 4K PTEs PD[2] = 2M PTE results in abort, page walker won't descend PD[1]. With new abort, ensuring valid PRL before handling a second abort. v2: - Revert to previous assert. - Revised non-leaf handling for interleaf child pt and leaf pte. - Update comments to specifications. (Stuart) - Remove unnecessary XE_PTE_PS64. (Matthew B) v3: - Modify secondary abort to only check non-leaf PTEs. (Matthew B) Fixes: b912138df299 ("drm/xe: Create page reclaim list on unbind") Signed-off-by: Brian Nguyen <brian3.nguyen@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Cc: Stuart Summers <stuart.summers@intel.com> Link: https://patch.msgid.link/20260305171546.67691-6-brian3.nguyen@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-03-16mtd: parsers: ofpart: call of_node_get() for dedicated subpartitionsCosmin Tanislav1-1/+1
In order to parse sub-partitions, add_mtd_partitions() calls parse_mtd_partitions() for all previously found partitions. Each partition will end up being passed to parse_fixed_partitions(), and its of_node will be treated as the ofpart_node. Commit 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()") added of_node_put() calls for ofpart_node on all exit paths. In the case where the partition passed to parse_fixed_partitions() has a parent, it is treated as a dedicated partitions node, and of_node_put() is wrongly called for it, even if of_node_get() was not called explicitly. On repeated bind / unbinds of the MTD, the extra of_node_put() ends up decrementing the refcount down to 0, which should never happen, resulting in the following error: OF: ERROR: of_node_release() detected bad of_node_put() on /soc/spi@80007000/flash@0/partitions/partition@0 Call of_node_get() to balance the call to of_node_put() done for dedicated partitions nodes. Fixes: 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()") Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com> Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-16mtd: parsers: ofpart: call of_node_put() only in ofpart_fail pathCosmin Tanislav1-1/+1
ofpart_none can only be reached after the for_each_child_of_node() loop finishes. for_each_child_of_node() correctly calls of_node_put() for all device nodes it iterates over as long as we don't break or jump out of the loop. Calling of_node_put() inside the ofpart_none path will wrongly decrement the ref count of the last node in the for_each_child_of_node() loop. Move the call to of_node_put() under the ofpart_fail label to fix this. Fixes: ebd5a74db74e ("mtd: ofpart: Check availability of reg property instead of name property") Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com> Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-16mtd: physmap: Drop leftovers of removed code for Baikal SoCAndy Shevchenko1-4/+0
The previous clean up killed the driver along with dropping some calls but missed one place to drop. Do it here. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202603121229.PPSg4X8q-lkp@intel.com/ Reported-by: Mark Brown <broonie@kernel.org> Closes: https://lore.kernel.org/r/abK8KXC70RC2K_fW@sirena.org.uk Fixes: 16d68d10f5b93 "(mtd: physmap: physmap-bt1-rom: Remove not-going-to-be-supported code for Baikal SoC)" Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-16drm/xe: Include running dword offset in default_lrc dumpsMatt Roper1-26/+39
Printing a running dword offset in the default_lrc_* debugfs entries makes it easier for developers to find the right offsets to use in regs/xe_lrc_layout.h and/or compare the default LRC contents against the bspec-documented LRC layout. Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com> Link: https://patch.msgid.link/20260311-default_lrc_offsets-v1-1-58d8ed3aa081@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>