summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-03-03drm/i915/dp_mst: Reuse intel_dp_check_link_state() in the HPD IRQ handlerImre Deak1-30/+4
Use intel_dp_check_link_state() in the MST HPD IRQ handler instead of open-coding it. Reviewed-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Imre Deak <imre.deak@intel.com> Link: https://patch.msgid.link/20260225164618.1261368-4-imre.deak@intel.com
2026-03-03drm/i915/dp_mst: Verify the link status always the same wayImre Deak1-2/+18
The MST link status should be always verified from the same DPCD registers after link training. Atm, both the legacy (0x202 - 0x205) and the ESI (0x200C - 0x200F) link status registers are used. Use always the latter ESI version of link status registers. v2: Propagate error from intel_dp_read_link_status(). (Jani, Luca) Cc: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Imre Deak <imre.deak@intel.com> Link: https://patch.msgid.link/20260225164618.1261368-3-imre.deak@intel.com
2026-03-03drm/i915/dp_mst: Reprobe connector if the IRQ ESI read failedImre Deak1-1/+1
An AUX access failure during HPD IRQ handling should be handled by falling back to a full connector detection, do so. Reviewed-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Imre Deak <imre.deak@intel.com> Link: https://patch.msgid.link/20260225164618.1261368-2-imre.deak@intel.com
2026-03-03drm/xe/tests: Change TEST_VRAM to work with 32-bit resource_size_tMichal Wajdeczko1-1/+1
We've picked the value of TEST_VRAM to match real VRAM size as found on the machines used by the CI, but that didn't work well on kernels that have 32-bit resource_size_t. Use smaller value instead. Reported-by: Nathan Chancellor <nathan@kernel.org> Closes: https://lore.kernel.org/intel-xe/20260227011639.GA1683727@ax162/ Fixes: cbe29da6f7c0 ("drm/xe/tests: Add KUnit tests for new VRAM fair provisioning") Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com> Link: https://patch.msgid.link/20260227160010.12425-1-michal.wajdeczko@intel.com
2026-03-03Revert "ACPI: PM: Let acpi_dev_pm_attach() skip devices without ACPI PM"Rafael J. Wysocki1-9/+0
Revert commit 88fad6ce090b ("ACPI: PM: Let acpi_dev_pm_attach() skip devices without ACPI PM") that introduced a SoundWire suspend regression [1]. It is actually not true that the commit above doesn't make a functional difference because acpi_subsys_suspend(), for example, may resume devices in runtime-suspend which affects the subsequent handling of those devices during the suspend transition. For this reason, the devices that were handled by the ACPI PM domain before that commit may be handled differently now which may lead to suspend-resume issues. Fixes: 88fad6ce090b ("ACPI: PM: Let acpi_dev_pm_attach() skip devices without ACPI PM") Reported-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com> Closes: https://github.com/thesofproject/linux/pull/5677#issuecomment-3984375077 [1] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2829615.mvXUDI8C0e@rafael.j.wysocki
2026-03-03drm/xe/display: clean up xe_initial_plane.c includesJani Nikula1-9/+3
Remove excess includes, group and sort include directives. Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/637eab7df00a540df6b7ca1ca345302864b6342f.1772212579.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-03drm/xe/compat: remove i915_vma.h from compatJani Nikula4-39/+23
Move compat i915_vma.h to xe_display_vma.h, and remove all extra cruft. Drop the i915_ggtt_offset() wrapper in favour of using xe_ggtt_node_addr() directly. The usefulness of the I915_TILING_X and I915_TILING_Y undef/define is unclear, since uapi/drm/i915_drm.h is included in other paths as well. The naming of struct i915_vma is a bit unfortunate in xe, but (at least for now) a necessity for maintaining type safety on the opaque type. Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/ecd5d75981b4b21c3da3b1831faceccfe385d898.1772212579.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-03drm/i915: add VMA to parent interfaceJani Nikula7-10/+27
It's unclear what the direction of the VMA abstraction in the parent interface should be, but convert i915_vma_fence_id() to parent interface for starters. This paves the way for making struct i915_vma opaque towards display. Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/036f4b2d20cc1b0a7ab814beb5bb914c53b6eb53.1772212579.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-03drm/i915/fbdev: stop debug logging i915_ggtt_offset()Jani Nikula1-4/+1
The debug logging in fbdev is the only user of i915_ggtt_offset() in display code. Just stop doing it to drop a dependency on i915_vma.h. Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/c3b84cb572c7ee94389e702aba4dcacb26c41673.1772212579.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-03xen/acpi-processor: fix _CST detection using undersized evaluation bufferDavid Thomson1-5/+2
read_acpi_id() attempts to evaluate _CST using a stack buffer of sizeof(union acpi_object) (48 bytes), but _CST returns a nested Package of sub-Packages (one per C-state, each containing a register descriptor, type, latency, and power) requiring hundreds of bytes. The evaluation always fails with AE_BUFFER_OVERFLOW. On modern systems using FFH/MWAIT entry (where pblk is zero), this causes the function to return before setting the acpi_id_cst_present bit. In check_acpi_ids(), flags.power is then zero for all Phase 2 CPUs (physical CPUs beyond dom0's vCPU count), so push_cxx_to_hypervisor() is never called for them. On a system with dom0_max_vcpus=2 and 8 physical CPUs, only PCPUs 0-1 receive C-state data. PCPUs 2-7 are stuck in C0/C1 idle, unable to enter C2/C3. This costs measurable wall power (4W observed on an Intel Core Ultra 7 265K with Xen 4.20). The function never uses the _CST return value -- it only needs to know whether _CST exists. Replace the broken acpi_evaluate_object() call with acpi_has_method(), which correctly detects _CST presence using acpi_get_handle() without any buffer allocation. This brings C-state detection to parity with the P-state path, which already works correctly for Phase 2 CPUs. Fixes: 59a568029181 ("xen/acpi-processor: C and P-state driver that uploads said data to hypervisor.") Signed-off-by: David Thomson <dt@linux-mail.net> Reviewed-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260224093707.19679-1-dt@linux-mail.net>
2026-03-03drm/bridge: waveshare-dsi: Add support for 1..4 DSI data lanesMarek Vasut1-1/+6
Parse the data lane count out of DT. Limit the supported data lanes to 1..4 which is the maximum available DSI pairs on the connector of any known panels which may use this bridge. Internally, this bridge is an ChipOne ICN6211 which loads its register configuration from a dedicated storage and its I2C does not seem to be accessible. The ICN6211 also supports up to 4 DSI lanes, so this is a hard limit. To avoid any breakage on old DTs where the parsing of data lanes from DT may fail, fall back to the original hard-coded value of 2 lanes and warn user. The lane configuration is preconfigured in the bridge for each of the WaveShare panels. The 13.3" DSI panel works with 4-lane configuration, others seem to use 2-lane configuration. This is a hardware property, so the actual count should come from DT. Reviewed-by: Joseph Guo <qijian.guo@nxp.com> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260115024004.660986-2-marek.vasut+renesas@mailbox.org Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-03-03regcache: Factor out regcache_hw_exit() helperAndy Shevchenko1-6/+9
Factor out regcache_hw_exit() helper to make error and exit paths clearer. This helps to avoid missing changes in case the code gets shuffled in the future. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20260303092820.2818138-2-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-03drm/xe: Fix memory leak in xe_vm_madvise_ioctlVarun Gupta1-1/+2
When check_bo_args_are_sane() validation fails, jump to the new free_vmas cleanup label to properly free the allocated resources. This ensures proper cleanup in this error path. Fixes: 293032eec4ba ("drm/xe/bo: Update atomic_access attribute on madvise") Cc: stable@vger.kernel.org # v6.18+ Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com> Signed-off-by: Varun Gupta <varun.gupta@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260223175145.1532801-1-varun.gupta@intel.com Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
2026-03-03platform/x86: dell-wmi-sysman: Don't hex dump plaintext password dataThorsten Blum1-1/+0
set_new_password() hex dumps the entire buffer, which contains plaintext password data, including current and new passwords. Remove the hex dump to avoid leaking credentials. Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20260303113050.58127-2-thorsten.blum@linux.dev Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-03-03net: phy: improve mdiobus_stats_acctHeiner Kallweit1-8/+3
- Remove duplicated preempt disable. Disabling preemption has been added to functions like u64_stats_update_begin() in the meantime. - Simplify branch structure Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/2ceeb542-986a-404e-ad0f-62e0a938ce7c@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03net: phy: inline helper mdio_bus_get_global_statHeiner Kallweit1-15/+8
mdio_bus_get_global_stat() has only one user. Inline it to simplify the code. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/7876625a-bd6f-42b4-8eb3-420f39d2f59a@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03net: mdio: use macro __ATTRIBUTE_GROUPSHeiner Kallweit1-12/+4
Use macro __ATTRIBUTE_GROUPS() to simplify the code. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/260fb184-c662-415c-b288-e1423097f2b9@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03net: mdio: constify attributes and attribute arraysHeiner Kallweit1-9/+10
Constify attributes and attribute arrays, using new member attrs_const of struct attribute_group. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/c20f17bb-3489-42b5-b8fe-457245ac6cb3@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03net: phy: avoid extra casting in mdio_bus_get_statHeiner Kallweit1-2/+2
Using void * instead of char * allows to remove one cast. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/054bbf60-d8ac-45ce-8b80-9c396469b7f9@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03net: phy: consider that mdio_bus_device_stat_field_show doesn't use member ↵Heiner Kallweit1-1/+0
address mdio_bus_device_stat_field_show() doesn't use the address member, so we don't have to initialize it. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/03a812a7-6871-4cc0-b5bf-ee80c6d6b5fd@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03net: mdio: use macro __ATTR to simplify the codeHeiner Kallweit1-11/+4
Use macro __ATTR to simplify the code. Note that __ATTR can't be used in MDIO_BUS_STATS_ADDR_ATTR_DECL because the included stringification would conflict with how argument file is passed. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/4877a4dc-247c-4453-b281-20a8d969b15b@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03net: mdio: extend struct mdio_bus_stat_attr instead of using dev_ext_attributeHeiner Kallweit1-25/+20
Currently the var member of struct dev_ext_attribute is used in a very ugly way. Extend struct mdio_bus_stat_attr instead, what allows to simplify the code and also slightly reduces memory footprint. Note: Member addr is renamed to avoid a conflict in macro MDIO_BUS_STATS_ADDR_ATTR_DECL. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/ce9f85d2-4f72-4b15-b868-210a8ced662d@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03drm/xe/guc: Skip access counter queue init for unsupported platformsHimal Prasad Ghimiray4-0/+18
Add a has_access_counter feature flag to the graphics IP descriptor and skip writing parameters for the access counter queue in guc_um_init_params(), leaving queue_params[2] zero-initialized to signal unavailability to the GuC. The queue_params[] array layout is fixed by firmware ABI, so we maintain the structure with queues 0 and 1 (page fault request/response) always configured, and queue 2 conditionally skipped based on the has_access_counter flag. Bspec: 59323 Cc: Stuart Summers <stuart.summers@intel.com> Cc: Matt Roper <matthew.d.roper@intel.com> Suggested-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Signed-off-by: Varun Gupta <varun.gupta1@intel.com> Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260225164748.2302380-1-varun.gupta@intel.com Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
2026-03-03Revert "driver core: enforce device_lock for driver_match_device()"Danilo Krummrich2-11/+2
This reverts commit dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") and commit 289b14592cef ("driver core: fix inverted "locked" suffix of driver_match_device()"). While technically correct, there is a major downside to this approach: When a device is already present in the system and a driver is registered on the same bus, we iterate over all devices registered on this bus to see if one of them matches. If we come across an already bound one where the corresponding driver crashed while holding the device lock (e.g. in probe()) we can't make any progress anymore. However, drivers are typically the least tested code in the kernel and hence it is a case that is likely to happen regularly. Besides hurting developer ergonomics, it potentially decreases chances of shutting things down cleanly and obtaining logs in production environments as well [1]. This came up in the context of a firewire bug, which only in combination with the reverted commit, caused the machine to hang [2]. Additionally, it was observed in [3]. Thus, revert commit dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") and add a brief note clarifying that an implementer of struct bus_type must not expect match() to be called with the device lock held. Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Link: https://lore.kernel.org/all/67f655bb-4d81-4609-b008-68d200255dd2@davidgow.net/ [2] Link: https://lore.kernel.org/lkml/CALbr=LZ4v7N=tO1vgOsyj9AS+XuNbn6kG-QcF+PacdMjSo0iyw@mail.gmail.com/ [3] Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Closes: https://lore.kernel.org/driver-core/CAHk-=wgJ_L1C=HjcYJotg_zrZEmiLFJaoic+PWthjuQrutrfJw@mail.gmail.com/ Reviewed-by: Gui-Dong Han <hanguidong02@gmail.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/20260302002545.19389-1-dakr@kernel.org [ Add additional Link: reference. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-03net: ti: davinci_emac: stop using bus type mdio_bus_typeHeiner Kallweit1-24/+15
This driver is the only user of mdio_bus_type outside phylib. Using mdio_bus_type isn't strictly needed here, so use an alternative approach. This will allow to make mdio_bus_type private to phylib in a follow-up series. Compile-tested only. Note: Devices supported by this driver are OF-only, therefore the string comparison in match_first_device() isn't needed any longer. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/cc8e83aa-48c3-4497-b6ad-760a7f9e25dc@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03accel/ivpu: Limit number of maximum contexts and doorbells per userKarol Wachowski3-20/+136
Implement per-user resource limits to prevent resource exhaustion. Root users can allocate all available contexts (128) and doorbells (255), while non-root users are limited to half of the available resources (64 contexts and 127 doorbells respectively). This prevents scenarios where a single user could monopolize NPU resources and starve other users on multi-user systems. Change doorbell ID and command queue ID allocation errors to debug messages as those are user triggered. Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com> Reviewed-by: Lizhi Hou <lizhi.hou@amd.com> Signed-off-by: Maciej Falkowski <maciej.falkowski@linux.intel.com> Link: https://patch.msgid.link/20260302202207.469442-1-maciej.falkowski@linux.intel.com
2026-03-03net: ti: icssg: Add HSR/PRP protocol frame filteringMD Danish Anwar3-2/+75
Add support for HSR and PRP protocol frame filtering in the ICSSG classifier by configuring filter table 3 (FT3) to detect PTP frames (EtherType 0x88F7) in HSR/PRP tagged packets. Also add rx_class_or_base to miig_rt_offsets structure to support RX_CLASS_OR register access, and fix typos in FT1_N_REG and FT3_N_REG macros (slize -> slice). Signed-off-by: MD Danish Anwar <danishanwar@ti.com> Link: https://patch.msgid.link/20260227174254.3821443-1-danishanwar@ti.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03dpll: zl3073x: add die temperature reporting for supported chipsIvan Vecera5-14/+42
Some zl3073x chip variants (0x1Exx, 0x2Exx and 0x3FC4) provide a die temperature status register with 0.1 C resolution. Add a ZL3073X_FLAG_DIE_TEMP chip flag to identify these variants and implement zl3073x_dpll_temp_get() as the dpll_device_ops.temp_get callback. The register value is converted from 0.1 C units to millidegrees as expected by the DPLL subsystem. To support per-instance ops selection, copy the base dpll_device_ops into struct zl3073x_dpll and conditionally set .temp_get during device registration based on the chip flag. Signed-off-by: Ivan Vecera <ivecera@redhat.com> Link: https://patch.msgid.link/20260227105300.710272-3-ivecera@redhat.com Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03dpll: zl3073x: detect DPLL channel count from chip ID at runtimeIvan Vecera4-167/+82
Replace the five per-variant zl3073x_chip_info structures and their exported symbol definitions with a single consolidated chip ID lookup table. The chip variant is now detected at runtime by reading the chip ID register from hardware and looking it up in the table, rather than being selected at compile time via the bus driver match data. Repurpose struct zl3073x_chip_info to hold a single chip ID, its channel count, and a flags field. Introduce enum zl3073x_flags with ZL3073X_FLAG_REF_PHASE_COMP_32 to replace the chip_id switch statement in zl3073x_dev_is_ref_phase_comp_32bit(). Store a pointer to the detected chip_info entry in struct zl3073x_dev for runtime access. This simplifies the bus drivers by removing per-variant .data and .driver_data references from the I2C/SPI match tables, and makes adding support for new chip variants a single-line table addition. Signed-off-by: Ivan Vecera <ivecera@redhat.com> Link: https://patch.msgid.link/20260227105300.710272-2-ivecera@redhat.com Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()Lorenzo Bianconi1-0/+1
Check frame length before accessing the mgmt fields in mt76_connac2_mac_write_txwi_80211 in order to avoid a possible oob access. Fixes: 577dbc6c656d ("mt76: mt7915: enable offloading of sequence number assignment") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260226-mt76-addba-req-oob-access-v1-3-b0f6d1ad4850@kernel.org [fix check to also cover mgmt->u.action.u.addba_req.capab, correct Fixes tag] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-03wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()Lorenzo Bianconi1-0/+1
Check frame length before accessing the mgmt fields in mt7925_mac_write_txwi_80211 in order to avoid a possible oob access. Fixes: c948b5da6bbec ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260226-mt76-addba-req-oob-access-v1-2-b0f6d1ad4850@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-03wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()Lorenzo Bianconi1-0/+1
Check frame length before accessing the mgmt fields in mt7996_mac_write_txwi_80211 in order to avoid a possible oob access. Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260226-mt76-addba-req-oob-access-v1-1-b0f6d1ad4850@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-03Merge tag 'ath-current-20260302' of ↵Johannes Berg2-26/+16
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v7.0-rc3 Fix issues with ath12k station statistics requests. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-03wifi: wlcore: Fix a locking bugBart Van Assche1-2/+2
Make sure that wl->mutex is locked before it is unlocked. This has been detected by the Clang thread-safety analyzer. Fixes: 45aa7f071b06 ("wlcore: Use generic runtime pm calls for wowlan elp configuration") Signed-off-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260223220102.2158611-26-bart.vanassche@linux.dev Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-03wifi: cw1200: Fix locking in error pathsBart Van Assche1-0/+2
cw1200_wow_suspend() must only return with priv->conf_mutex locked if it returns zero. This mutex must be unlocked if an error is returned. Add mutex_unlock() calls to the error paths from which that call is missing. This has been detected by the Clang thread-safety analyzer. Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets") Signed-off-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260223220102.2158611-25-bart.vanassche@linux.dev Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-03octeon_ep_vf: avoid compiler and IQ/OQ reorderingVimlesh Kumar2-16/+33
Utilize READ_ONCE and WRITE_ONCE APIs for IO queue Tx/Rx variable access to prevent compiler optimization and reordering. Additionally, ensure IO queue OUT/IN_CNT registers are flushed by performing a read-back after writing. The compiler could reorder reads/writes to pkts_pending, last_pkt_count, etc., causing stale values to be used when calculating packets to process or register updates to send to hardware. The Octeon hardware requires a read-back after writing to OUT_CNT/IN_CNT registers to ensure the write has been flushed through any posted write buffers before the interrupt resend bit is set. Without this, we have observed cases where the hardware didn't properly update its internal state. wmb/rmb only provides ordering guarantees but doesn't prevent the compiler from performing optimizations like caching in registers, load tearing etc. Fixes: 1cd3b407977c3 ("octeon_ep_vf: add Tx/Rx processing and interrupt support") Signed-off-by: Sathesh Edara <sedara@marvell.com> Signed-off-by: Shinas Rasheed <srasheed@marvell.com> Signed-off-by: Vimlesh Kumar <vimleshk@marvell.com> Link: https://patch.msgid.link/20260227091402.1773833-5-vimleshk@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03octeon_ep_vf: Relocate counter updates before NAPIVimlesh Kumar1-2/+15
Relocate IQ/OQ IN/OUT_CNTS updates to occur before NAPI completion. Moving the IQ/OQ counter updates before napi_complete_done ensures 1. Counter registers are updated before re-enabling interrupts. 2. Prevents a race where new packets arrive but counters aren't properly synchronized. Fixes: 1cd3b407977c3 ("octeon_ep_vf: add Tx/Rx processing and interrupt support") Signed-off-by: Sathesh Edara <sedara@marvell.com> Signed-off-by: Shinas Rasheed <srasheed@marvell.com> Signed-off-by: Vimlesh Kumar <vimleshk@marvell.com> Link: https://patch.msgid.link/20260227091402.1773833-4-vimleshk@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03octeon_ep: avoid compiler and IQ/OQ reorderingVimlesh Kumar2-16/+32
Utilize READ_ONCE and WRITE_ONCE APIs for IO queue Tx/Rx variable access to prevent compiler optimization and reordering. Additionally, ensure IO queue OUT/IN_CNT registers are flushed by performing a read-back after writing. The compiler could reorder reads/writes to pkts_pending, last_pkt_count, etc., causing stale values to be used when calculating packets to process or register updates to send to hardware. The Octeon hardware requires a read-back after writing to OUT_CNT/IN_CNT registers to ensure the write has been flushed through any posted write buffers before the interrupt resend bit is set. Without this, we have observed cases where the hardware didn't properly update its internal state. wmb/rmb only provides ordering guarantees but doesn't prevent the compiler from performing optimizations like caching in registers, load tearing etc. Fixes: 37d79d0596062 ("octeon_ep: add Tx/Rx processing and interrupt support") Signed-off-by: Sathesh Edara <sedara@marvell.com> Signed-off-by: Shinas Rasheed <srasheed@marvell.com> Signed-off-by: Vimlesh Kumar <vimleshk@marvell.com> Link: https://patch.msgid.link/20260227091402.1773833-3-vimleshk@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03octeon_ep: Relocate counter updates before NAPIVimlesh Kumar1-4/+15
Relocate IQ/OQ IN/OUT_CNTS updates to occur before NAPI completion, and replace napi_complete with napi_complete_done. Moving the IQ/OQ counter updates before napi_complete_done ensures 1. Counter registers are updated before re-enabling interrupts. 2. Prevents a race where new packets arrive but counters aren't properly synchronized. napi_complete_done (vs napi_complete) allows for better interrupt coalescing. Fixes: 37d79d0596062 ("octeon_ep: add Tx/Rx processing and interrupt support") Signed-off-by: Sathesh Edara <sedara@marvell.com> Signed-off-by: Shinas Rasheed <srasheed@marvell.com> Signed-off-by: Vimlesh Kumar <vimleshk@marvell.com> Link: https://patch.msgid.link/20260227091402.1773833-2-vimleshk@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03coresight: cti: Properly handle negative offsets in cti_reg32_{show|store}()Leo Yan1-2/+8
Return an error when the offset is negative. Signed-off-by: Leo Yan <leo.yan@arm.com> Reviewed-by: Mike Leach <mike.leach@Arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-8-b30fada3cfec@arm.com
2026-03-03coresight: cti: Remove hw_enabled flagLeo Yan3-13/+4
The enable_req_count field already tracks whether the CTI device is enabled. A non-zero value indicates that the device is active, the hw_enabled flag is redundant if so. Remove hw_enabled and update cti_is_active() to check enable_req_count. Replace open-coded enable_req_count checks with cti_is_active(). Reviewed-by: Mike Leach <mike.leach@arm.com> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-7-b30fada3cfec@arm.com
2026-03-03coresight: cti: Remove hw_powered flagLeo Yan3-33/+13
Since the CPU PM code has been removed from the CTI driver and the device is enabled via runtime PM, pm_runtime_active() can be used to check whether the device is powered. As a result, the hw_powered flag is redundant, remove it. Reviewed-by: Mike Leach <mike.leach@arm.com> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-6-b30fada3cfec@arm.com
2026-03-03coresight: cti: Rename cti_active() to cti_is_active()Leo Yan3-12/+12
Rename cti_active() to cti_is_active() to clarify that it checks whether the CTI device is active. Reviewed-by: Mike Leach <mike.leach@arm.com> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-5-b30fada3cfec@arm.com
2026-03-03coresight: cti: Remove CPU power management codeLeo Yan1-183/+3
According Arm ARM, the CTI ASICCTL register: "It is IMPLEMENTATION DEFINED whether ASICCTL is implemented in the Core power domain or in the Debug power domain." This is the only CTI register that may reside in the core power domain. However, it has been confirmed that Arm designed CTIs place ASICCTL in the debug power domain. Furthermore, ASICCTL is implemented only when CTIDEVID.EXTMUXNUM is non-zero, which is a rare case for CPU CTIs. For these reasons, it is safe to conclude that all CTI registers are not located in the CPU power domain. Therefore, the CTI driver does not need CPU power management. This commit removes the CPU power management from CTI driver. Reviewed-by: Mike Leach <mike.leach@arm.com> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-4-b30fada3cfec@arm.com
2026-03-03coresight: cti: Access ASICCTL only when implementedLeo Yan3-1/+19
According to the Arm ARM (DDI 0487 L.b), ASICCTL is implemented only when CTIDEVID.EXTMUXNUM is non-zero. Based on CTIDEVID.EXTMUXNUM, add a flag 'asicctl_impl' to indicate whether the register is implemented, and access ASICCTL conditionally based on the flag. Allow the sysfs node to be visible only when the register is implemented. Reviewed-by: Mike Leach <mike.leach@arm.com> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-3-b30fada3cfec@arm.com
2026-03-03coresight: cti: Fix register readsLeo Yan3-4/+14
Introduce cti_read_single_reg() as an interface for reading registers with unlocking the CS lock. Consolidate register read in sysfs interfaces using this new helper. Fixes: b5213376c240 ("coresight: cti: Add sysfs access to program function registers") Fixes: 1a556ca6cc24 ("coresight: cti: Add sysfs coresight mgmt register access") Reviewed-by: Mike Leach <mike.leach@arm.com> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-2-b30fada3cfec@arm.com
2026-03-03coresight: cti: Make spinlock usage consistentLeo Yan2-116/+103
The spinlock is acquired sometimes with IRQs disabled and sometimes without. This leads to inconsistent semantics: the lock can be either HARDIRQ-safe or HARDIRQ-unsafe, which may trigger lockdep complaints. Make spinlock usage consistent by acquiring it with disabling IRQs. It is possible for sysfs knobs to acquire the spinlock for accessing a CTI device, while at the same time a perf session sends an IPI to enable the same CTI device. In this case, the spinlock must be IRQ-safe, which is why all lock acquisitions are changed to disable IRQs. Use guard() and scoped_guard() for spinlock to tidy up the code. Fixes: 984f37efa385 ("coresight: cti: Write regsiters directly in cti_enable_hw()") Tested-by: James Clark <james.clark@linaro.org> Reviewed-by: Mike Leach <mike.leach@arm.com> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-1-b30fada3cfec@arm.com
2026-03-03net: mana: Trigger VF reset/recovery on health check failure due to HWC timeoutDipayaan Roy2-33/+41
The GF stats periodic query is used as mechanism to monitor HWC health check. If this HWC command times out, it is a strong indication that the device/SoC is in a faulty state and requires recovery. Today, when a timeout is detected, the driver marks hwc_timeout_occurred, clears cached stats, and stops rescheduling the periodic work. However, the device itself is left in the same failing state. Extend the timeout handling path to trigger the existing MANA VF recovery service by queueing a GDMA_EQE_HWC_RESET_REQUEST work item. This is expected to initiate the appropriate recovery flow by suspende resume first and if it fails then trigger a bus rescan. This change is intentionally limited to HWC command timeouts and does not trigger recovery for errors reported by the SoC as a normal command response. Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/aaFShvKnwR5FY8dH@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loadedJiayuan Chen2-2/+9
bond_option_mode_set() already rejects mode changes that would make a loaded XDP program incompatible via bond_xdp_check(). However, bond_option_xmit_hash_policy_set() has no such guard. For 802.3ad and balance-xor modes, bond_xdp_check() returns false when xmit_hash_policy is vlan+srcmac, because the 802.1q payload is usually absent due to hardware offload. This means a user can: 1. Attach a native XDP program to a bond in 802.3ad/balance-xor mode with a compatible xmit_hash_policy (e.g. layer2+3). 2. Change xmit_hash_policy to vlan+srcmac while XDP remains loaded. This leaves bond->xdp_prog set but bond_xdp_check() now returning false for the same device. When the bond is later destroyed, dev_xdp_uninstall() calls bond_xdp_set(dev, NULL, NULL) to remove the program, which hits the bond_xdp_check() guard and returns -EOPNOTSUPP, triggering: WARN_ON(dev_xdp_install(dev, mode, bpf_op, NULL, 0, NULL)) Fix this by rejecting xmit_hash_policy changes to vlan+srcmac when an XDP program is loaded on a bond in 802.3ad or balance-xor mode. commit 39a0876d595b ("net, bonding: Disallow vlan+srcmac with XDP") introduced bond_xdp_check() which returns false for 802.3ad/balance-xor modes when xmit_hash_policy is vlan+srcmac. The check was wired into bond_xdp_set() to reject XDP attachment with an incompatible policy, but the symmetric path -- preventing xmit_hash_policy from being changed to an incompatible value after XDP is already loaded -- was left unguarded in bond_option_xmit_hash_policy_set(). Note: commit 094ee6017ea0 ("bonding: check xdp prog when set bond mode") later added a similar guard to bond_option_mode_set(), but bond_option_xmit_hash_policy_set() remained unprotected. Reported-by: syzbot+5a287bcdc08104bc3132@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6995aff6.050a0220.2eeac1.014e.GAE@google.com/T/ Fixes: 39a0876d595b ("net, bonding: Disallow vlan+srcmac with XDP") Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com> Link: https://patch.msgid.link/20260226080306.98766-2-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-03Merge drm/drm-next into drm-misc-nextThomas Zimmermann268-2450/+4790
Backmerge fixes from v7.0-rc2 into drm-misc-next. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>