summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-05-26net: mdio: realtek-rtl9300: Add command/C22 registerMarkus Stockhausen
Command issuing/status bits and C22 data share the same register. In the future the number of places where this register is used will be: - One generic command helper/runner for all devices that will access the command bits of the register - 8 device specific C22 read/write functions that will access the C22 data fields. Thus name the register c22_data to align with the existing c45_data register. This way all device specific helpers will have a common view on the to-be-fed data. Add the register to the existing structure and make use of it where needed. Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://patch.msgid.link/20260521175918.1494797-7-markus.stockhausen@gmx.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-26net: mdio: realtek-rtl9300: Add register structureMarkus Stockhausen
The MDIO controller of the Realtek Otto switches has either 4 or 7 command registers. This depends on the number of supported ports. These registers are "scattered" around the MMIO block and their addresses depend on the specific model. Nevertheless all command registers share a common pattern: - A mask register with one bit per addressed port (remark: the driver internally works on ports instead of bus/address) - A I/O data register that transfers the to be read/written data - A C45 registers that takes devnum and regnum - A C22 register that also includes run and status bits (remark: this also takes the Realtek proprietary C22 PHY page) Provide an additional structure for these command registers so it can be reused in two places. 1. For defining the register addresses in the regmap. 2. For defining the to be read/written register data This will finally result in access patterns like static int otto_emdio_run_cmd(u32 cmd, struct rtl_mdio_cmd_regs *cmd_regs, ...) { regmap_write(regmap, priv->info->reg->cmd_regs.c45_data, cmd_regs->c45_data); ... } static int otto_emdio_9300_write_c45(...) { struct otto_emdio_cmd_regs cmd_regs = { .c45_data = ... .io_data = ..., .port_mask = ..., }; return otto_emdio_run_cmd(RTL9300_CMD_WRITE_C45, &cmd_regs, ...); } As a first step start with the C45 register. This one takes the devnum/regnum data that is stored in the high/low 16 bits. Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://patch.msgid.link/20260521175918.1494797-6-markus.stockhausen@gmx.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-26net: mdio: realtek-rtl9300: Add pages to info structureMarkus Stockhausen
The Realtek ethernet MDIO controller has a proprietary paging feature that is closely aligned with Realtek based PHYs. These PHY know "pages" for C22 access. Those can be switched via reads/writes to register 31. Usually the paged access must be programmed in four steps. 1. read/save page register 2. change "page" register 31 3. read/write data register (on the given page) 4. restore page register The controller can run all this in hardware with one single request from the driver. It is given the page, the register and the data and takes care of all the rest. This reduces CPU load. The number of supported pages depend on the model. This is either 4096 for low port count SOCs (up to 28 ports) or 8192 for high port count SOCs (up to 56 ports). There is however one special page that allows to pass through all C22 commands directly to the PHY - without any caching. This so called raw page is dependent of the hardware. It is the highest supported page number minus 1. Provide the number of supported pages as a device specific property. This new "num_pages" aligns with the existing properties and gives an better insight into the hardware layout than just defining the number of the raw page. The later directly derives from that and can be accessed with the new RAW_PAGE() macro. Make use of it where needed. Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://patch.msgid.link/20260521175918.1494797-5-markus.stockhausen@gmx.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-26net: mdio: realtek-rtl9300: Add ports to info structureMarkus Stockhausen
The ethernet MDIO controller in the Realtek Otto series has a very special command register style. Instead of working with bus/address it works on ethernet port numbers. For this the controller is initialized via mapping registers that tell which port is mapped to which bus/address. Every request to the driver is then converted as follows 1. Kernel calls driver with bus/address 2. Driver converts bus/address to port and issues command 3. Hardware maps port back to bus/address The number of ports is different for each device. Make this configurable by adding a property to the info structure. Switch the existing usage of MAX_PORTS to this new property where needed. Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://patch.msgid.link/20260521175918.1494797-4-markus.stockhausen@gmx.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-26net: mdio: realtek-rtl9300: Add device specific info structureMarkus Stockhausen
Device properties of the RTL930x SOCs are hardcoded into the MDIO driver. This must be relaxed to support additional devices like the RTL838x or RTL839x. These do not have 4 SMI buses but 1 or 2 instead. To support multiple devices establish an info structure that contains individual variations of each series. As a first use case add the number of buses into this structure and use it where needed. Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://patch.msgid.link/20260521175918.1494797-3-markus.stockhausen@gmx.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-26net: mdio: realtek-rtl9300: enhance documentation & namingMarkus Stockhausen
The Realtek ethernet MDIO driver currently only serves SOCs from the Realtek RTL930x series. This is only one lineup of the Realtek Otto switch series that also knows RTL838x, RTL839x, RTL931x devices. All of these share similar hardware with comparable MMIO access logic but have individual variations. Important to note - Controller works on switch ports instead of buses and addresses. - Devices incorporate additional MDIO hardware. E.g. - an auxiliary MDIO controller for GPIO expanders [1] - a MDIO style SerDes controller [2] To avoid future confusion enhance the driver documentation and function naming. Make clear what this driver is about and what parts are generic and what parts are device specific. For this rename the function and structure prefix as follows: - for generic functions use otto_emdio_ - for device specific helpers use e.g. otto_emdio_9300_ This prefix naming tries to align with the watchdog timer [3]. It paves the way so that drivers for the other Realtek Otto MDIO controllers can be added in future commits using the same naming convention. Remark 1: The read/write functions are kept device specific for now because they will only fit the RTL930x SOCs. Renaming will take place as soon as the I/O handling will be generalized. Remark 2: The driver name "mdio-rtl9300" is kept for now. [1] https://git.openwrt.org/openwrt/openwrt/tree/target/linux/realtek/patches-6.18/723-net-mdio-Add-Realtek-Otto-auxiliary-controller.patch [2] https://git.openwrt.org/openwrt/openwrt/tree/target/linux/realtek/files-6.18/drivers/net/mdio/mdio-realtek-otto-serdes.c [3] https://elixir.bootlin.com/linux/v7.0/source/drivers/watchdog/realtek_otto_wdt.c Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://patch.msgid.link/20260521175918.1494797-2-markus.stockhausen@gmx.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-26pinctrl: meson: amlogic-a4: fix gpio output glitchXianwei Zhao
When the system transitions from bootloader to kernel, the GPIO is expected to keep driving high. However, the Linux kernel first configures the pin direction and then sets the output value. This may cause a brief low-level glitch on the GPIO line, which can be problematic for regulator control. By configuring the output value before switching the pin direction to output, the glitch can be avoided. This commit fixes the issue by swapping the configuration order. Fixes: 6e9be3abb78c ("pinctrl: Add driver support for Amlogic SoCs") Signed-off-by: Xianwei Zhao <xianwei.zhao@amlogic.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-05-26gpio: add kunit test cases for the GPIO subsystemBartosz Golaszewski
Add a module containing kunit test cases for GPIO core. The idea is to use it to test functionalities that can't easily be tested from user-space with kernel selftests or GPIO character device test suites provided by the libgpiod package. For now add test cases that verify software node based lookup and ensure that a GPIO provider unbinding with active consumers does not cause a crash. Reviewed-by: David Gow <david@davidgow.net> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260522-gpiolib-kunit-v3-3-b15fe6987430@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-26exec_state: relocate dumpable informationChristian Brauner (Amutable)
The dumpable flag captured at execve() is consulted by __ptrace_may_access() and several /proc owner / visibility checks. It lives on mm_struct today, which exit_mm() clears from the task long before the task itself is reaped. exec_state is anchored to the execve() that established the current privilege domain. CLONE_VM siblings refcount-share the parent's exec_state via copy_exec_state(); non-CLONE_VM clones allocate a fresh exec_state inheriting the parent's dumpable mode and user_ns reference via task_exec_state_copy(). execve() allocates a fresh instance (via alloc_task_exec_state() in begin_new_exec()) and installs it under task_lock + exec_update_lock with task_exec_state_replace(). init_task uses a static instance. The dumpable mode now lives on task->exec_state->dumpable. task->mm->flags no longer carries dumpability; MMF_DUMPABLE_MASK is removed, but MMF_DUMPABLE_BITS is reserved so MMF_DUMP_FILTER_* bit positions remain stable for the /proc/<pid>/coredump_filter ABI. The task->user_dumpable cache bit and its assignment in exit_mm() are removed; readers go through get_dumpable(task) directly. coredump_params gains a snapshot field cprm.dumpable, populated from get_dumpable(current) at vfs_coredump() entry, replacing the previous __get_dumpable(cprm->mm_flags) consumers in fs/coredump.c and fs/pidfs.c. The user namespace recorded at execve() is consulted by __ptrace_may_access() and by /proc/PID/* owner derivation. Move the captured user_ns onto task_exec_state, which stays attached to the task past exit_mm() and across exit_files(). bprm grows a user_ns field staged in bprm_mm_init() with the caller's user_ns, narrowed by would_dump() to the closest privileged ancestor, and consumed by exec_mmap() via alloc_task_exec_state(bprm->user_ns). free_bprm() releases the staging reference. mm_struct loses ->user_ns entirely. Initializers in init-mm, efi_mm, and the implicit one in mm_init()/dup_mm()/mm_alloc() are removed; __mmdrop() drops the matching put_user_ns(). The kthread_use_mm() WARN_ON_ONCE(!mm->user_ns) is no longer meaningful and goes too. Reviewed-by: Jann Horn <jannh@google.com> Link: https://patch.msgid.link/20260520-work-task_exec_state-v3-4-69f895bc1385@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-05-26net: team: fix NULL pointer dereference in team_xmit during mode changeWeiming Shi
__team_change_mode() clears team->ops with memset() before restoring safe dummy handlers via team_adjust_ops(). A concurrent team_xmit() running under RCU on another CPU can read team->ops.transmit during this window and call a NULL function pointer, crashing the kernel. The race requires a mode change (CAP_NET_ADMIN) concurrent with transmit on the team device. BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: 0010 [#1] SMP KASAN NOPTI RIP: 0010:0x0 Call Trace: team_xmit (drivers/net/team/team_core.c:1853) dev_hard_start_xmit (net/core/dev.c:3904) __dev_queue_xmit (net/core/dev.c:4871) packet_sendmsg (net/packet/af_packet.c:3109) __sys_sendto (net/socket.c:2265) The original code assumed that no ports means no traffic, so mode changes could freely memset()/memcpy() the ops. AF_PACKET with forced carrier breaks that assumption. Prevent the race instead of making it safe: replace memset()/memcpy() with per-field updates that never touch transmit or receive. Those two handlers are managed solely by team_adjust_ops(), which already installs dummies when tx_en_port_count == 0 (always true during mode change since no ports are present). WRITE_ONCE/READ_ONCE prevent store/load tearing on the handler pointers. synchronize_net() before exit_op() drains in-flight readers that may still reference old mode state from before port removal switched the handlers to dummies. Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device") Reported-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Weiming Shi <bestswngs@gmail.com> Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev> Link: https://patch.msgid.link/20260521081159.1491563-3-bestswngs@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-26gpiolib: Mark gpio_devt, gpiolib_initialized and gpio_stub_drv as ↵Len Bao
__ro_after_init The 'gpio_devt' and 'gpiolib_initialized' variables are initialized only during the init phase in the 'gpiolib_dev_init' function and never changed. So, mark these as __ro_after_init. The 'gpio_stub_drv' variable is initialized only in the declaration and never changed. So, this variable could be 'const', but using the 'driver_register' and 'driver_unregister' functions discards the 'const' qualifier. Therefore, as an alternative, mark it as a __ro_after_init. Signed-off-by: Len Bao <len.bao@gmx.us> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260516105737.45174-1-len.bao@gmx.us Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-26drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enableJouni Högander
We are observing following warnings: *ERROR* power well DC_off state mismatch (refcount 0/enabled 1) gen9_dc_off_power_well_enabled is considering target state DC_STATE_DISABLE as DC_OFF power well being enabled. Fix this by using wakeref for the purpose. To achieve this we need to modify notification code as well. Currently it is possible that PSR gets notified vblank enable/disable twice on same status. This is currently not a problem as it is just triggering call to intel_display_power_set_target_dc_state with same target state as a parameter. When using wakeref this becomes a problem due to reference counting. Fix this storing vbank status on last notification and use that to ensure there are no more than one notification with same vblank status. v2: ensure there is no subsequent notifications with same status Fixes: aa451abcffb5 ("drm/i915/display: Prevent DC6 while vblank is enabled for Panel Replay") Cc: <stable@vger.kernel.org> # v6.13+ Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/20260520104944.239797-2-jouni.hogander@intel.com (cherry picked from commit 35485ac56d878192a3829a58cb26503125ec7104) Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-05-26drm/i915/psr: Block DC states on vblank enable when Panel Replay supportedJouni Högander
Currently we are blocking DC states only when Panel Replay is enabled on vblank enable. It may happen that Panel Replay is getting enabled when vblank is already enabled. Fix this by blocking DC states always if Panel Replay is supported. While at it take care of possible dual eDP case by looping all encoders supporting PSR. Fixes: 0c427ac78a1d ("drm/i915/psr: Add interface to notify PSR of vblank enable/disable") Cc: <stable@vger.kernel.org> # v6.16+ Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/20260520104944.239797-1-jouni.hogander@intel.com (cherry picked from commit eb5911f990554f7ce947dd53df00c114362e4465) Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-05-26drm/i915/color: Fix HDR pre-CSC LUT programming loopPranay Samala
The integer lut programming loop never executes completely due to incorrect condition (i++ > 130). Fix to properly program 129th+ entries for values > 1.0. Cc: <stable@vger.kernel.org> #v6.19 Fixes: 82caa1c8813f ("drm/i915/color: Program Pre-CSC registers") Signed-off-by: Pranay Samala <pranay.samala@intel.com> Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Reviewed-by: Uma Shankar <uma.shankar@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260519075308.383877-1-pranay.samala@intel.com (cherry picked from commit f33862ec3e8849ad7c0a3dd46719083b13ade248) Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-05-26drm/i915/aux: use polling when irqs are unavailableMichał Grzelak
PTL with physically disconnected display was observed to have 40s longer execution time when testing xe_fault_injection@xe_guc_mmio_send_recv. The issue has not been seen when reverting commit 40a9f77a28fa ("Revert "drm/i915/dp: change aux_ctl reg read to polling read""). Apparently the configuration suffers from not having AUX enabled when using interrupts. One probable cause can be xe enabling interrupts too late: interrupts need memory allocations which currently can't be done before the display FB takeover is done. As for now, use polling for AUX in case interrupts are unavailable. Fixes: 40a9f77a28fa ("Revert "drm/i915/dp: change aux_ctl reg read to polling read"") Suggested-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Signed-off-by: Michał Grzelak <michal.grzelak@intel.com> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260416163744.288107-1-michal.grzelak@intel.com (cherry picked from commit 05e0550b65cd1604bd515fbc65f522bce4c10a87) Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-05-26drm/i915: Fix potential UAF in TTM object purgeJanusz Krzysztofik
TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(), move casting it to an i915_tt object later to actually get the right pointer. A user reported hitting the following bug under heavy use on DG2: [26620.095550] Oops: general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 1 SMP NOPTI [26620.095556] CPU: 2 UID: 0 PID: 631 Comm: Xorg Not tainted 6.18.8 #1 PREEMPT(lazy) [26620.095558] Hardware name: ASRock B850M Steel Legend WiFi/B850M Steel Legend WiFi, BIOS 3.50 09/18/2025 [26620.095559] RIP: 0010:i915_ttm_purge+0x84/0x100 [i915] [26620.095604] Code: 00 00 00 48 8d 54 24 10 48 89 e6 48 89 fb e8 83 aa ae ff 85 c0 75 6f 48 83 bb a8 01 00 00 00 74 2c 48 8b 45 78 48 85 c0 74 23 <48> 8b 78 20 48 c7 c2 ff ff ff ff 31 f6 e8 7a 73 e3 e0 48 8b 7d 78 [26620.095605] RSP: 0018:ffffc90005fd7430 EFLAGS: 00010282 [26620.095607] RAX: a56b6b6b6b6b6b6b RBX: ffff8881f46c3dc0 RCX: 0000000000000000 [26620.095608] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 00000000ffffffff [26620.095609] RBP: ffff888289610f00 R08: 0000000000000001 R09: ffff88823b022000 [26620.095609] R10: ffff888103029b28 R11: ffff8881fc7f3800 R12: ffff88810b6150d0 [26620.095609] R13: ffff888289610f00 R14: 0000000000000000 R15: ffff8881f46c3dc0 [26620.095610] FS: 00007f1004d86900(0000) GS:ffff88901c858000(0000) knlGS:0000000000000000 [26620.095611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [26620.095611] CR2: 00007f0fdf489000 CR3: 000000035b0c1000 CR4: 0000000000750ef0 [26620.095612] PKRU: 55555554 [26620.095612] Call Trace: [26620.095615] <TASK> [26620.095615] i915_ttm_move+0x2b9/0x420 [i915] [26620.095642] ? ttm_tt_init+0x65/0x80 [ttm] [26620.095644] ? i915_ttm_tt_create+0xc6/0x150 [i915] [26620.095667] ttm_bo_handle_move_mem+0xb6/0x160 [ttm] [26620.095669] ttm_bo_evict+0x100/0x150 [ttm] [26620.095671] ? preempt_count_add+0x64/0xa0 [26620.095673] ? _raw_spin_lock+0xe/0x30 [26620.095675] ? _raw_spin_unlock+0xd/0x30 [26620.095675] ? i915_gem_object_evictable+0xb7/0xd0 [i915] [26620.095704] ttm_bo_evict_cb+0x6e/0xd0 [ttm] [26620.095705] ttm_lru_walk_for_evict+0xa6/0x200 [ttm] [26620.095708] ttm_bo_alloc_resource+0x185/0x4f0 [ttm] [26620.095709] ? init_object+0x62/0xd0 [26620.095712] ttm_bo_validate+0x7a/0x180 [ttm] [26620.095713] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095714] __i915_ttm_get_pages+0xb0/0x170 [i915] [26620.095737] i915_ttm_get_pages+0x9f/0x150 [i915] [26620.095759] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915] [26620.095786] ? alloc_debug_processing+0xd0/0x100 [26620.095787] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095788] ? i915_vma_instance+0xa0/0x4e0 [i915] [26620.095822] __i915_gem_object_get_pages+0x2f/0x40 [i915] [26620.095848] i915_vma_pin_ww+0x706/0x980 [i915] [26620.095875] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915] [26620.095904] eb_validate_vmas+0x170/0xa00 [i915] [26620.095930] i915_gem_do_execbuffer+0x1201/0x2b40 [i915] [26620.095953] ? alloc_debug_processing+0xd0/0x100 [26620.095954] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095955] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915] [26620.095977] ? __wake_up_sync_key+0x32/0x50 [26620.095979] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915] [26620.096001] ? __slab_alloc.isra.0+0x67/0xc0 [26620.096003] i915_gem_execbuffer2_ioctl+0x11a/0x240 [i915] Results from decode_stacktrace.sh pointed to dereference of a file pointer field of a i915 TTM page vector container associated with an object being purged on eviction. That path is taken when the object is marked as no longer needed. Code analysis revealed a possibility of the i915 TTM page vector container being replaced with a new instance inside a function that purges content of the object, should it be still busy. That function is called, indirectly via a more general function that changes the object's placement and caching policy, before the problematic dereference, but still after a pointer to the container is captured, rendering the pointer no longer valid. Fix the issue by capturing the pointer to the container only after its potential replacement. v2: Move the container_of() inside the if block (Sebastian), - a simplified version of the commit description that explains briefly why the change is necessary (Christian). Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/14882 Fixes: 7ae034590ceae ("drm/i915/ttm: add tt shmem backend") Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> Cc: stable@vger.kernel.org # v5.17+ Cc: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Sebastian Brzezinka <sebastian.brzezinka@intel.com> Cc: Christian König <christian.koenig@amd.com> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com> Link: https://lore.kernel.org/r/20260508122612.469227-2-janusz.krzysztofik@linux.intel.com (cherry picked from commit 4462966a93eb185849b7f174f0d0de53476d00a4) Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-05-26drm: verisilicon: fix build failure of cursor plane codeIcenowy Zheng
The cursor plane patch was stalled for a too long time that the struct drm_atomic_state parameter of atomic modeset hooks has been changed to struct drm_atomic_commit. Fix this by replacing the parameter's type. All helpers that retrieve information from this struct are also changed so simply replacing the type works. Fixes: 8c4ae2189125 ("drm: verisilicon: add support for cursor planes") Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260525153618.1336239-1-zhengxingda@iscas.ac.cn
2026-05-26gpio: mxc: fix irq_high handlingAlexander Stein
If port->irq_high is -1 (fsl,imx21-gpio compatible) and gpio_idx is >= 16 enable_irq_wake() is called with -1 which is wrong. Fixes: 5f6d1998adeb ("gpio: mxc: release the parent IRQ in runtime suspend") Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260526063504.25916-1-alexander.stein@ew.tq-group.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-26s390/zcore: Use octal permissionHeiko Carstens
Replace symbolic permissions with octal permissions, which are preferred. Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-26s390/zcore: Removed unused variablesHeiko Carstens
allmodconfig with clang W=1 points out unused global variables: drivers/s390/char/zcore.c:49:23: error: variable 'zcore_reipl_file' set but not used [-Werror,-Wunused-but-set-global] drivers/s390/char/zcore.c:50:23: error: variable 'zcore_hsa_file' set but not used [-Werror,-Wunused-but-set-global] Remove both of them, since there is no point in keeping them. Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-26s390/sclp: Remove unused sclp_vt220_buffered_chars variableHeiko Carstens
allmodconfig with clang W=1 points out an unused global variable: drivers/s390/char/sclp_vt220.c:85:12: error: variable 'sclp_vt220_buffered_chars' set but not used [-Werror,-Wunused-but-set-global] Just remove it. Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-26accel/ivpu: prevent uninitialized data bug in debugfsDan Carpenter
The simple_write_to_buffer() will only initialize data starting from the *pos offset so if it's non-zero then the first part of the buffer uninitialized. Really, if *pos is non-zero then this code won't work so just check for that at the start of the function. Fixes: 320323d2e545 ("accel/ivpu: Add debugfs interface for setting HWS priority bands") Signed-off-by: Dan Carpenter <error27@gmail.com> Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com> Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com> Link: https://patch.msgid.link/ahP24m6Mii9EDL7Q@stanley.mountain
2026-05-26pwm: pca9685: Use named initializers for struct i2c_device_idUwe Kleine-König (The Capable Hub)
While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. This patch doesn't modify the compiled arrays, only their representation in source form benefits. The former was confirmed with x86 and arm64 builds. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20260518172323.932774-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-26pwm: pxa: Add optional bus clockYixun Lan
Add one secondary optional bus clock for the PWM PXA driver, also keep it compatible with old single clock. The SpacemiT K3 SoC require a bus clock for PWM controller, acquire and enable it during probe phase. Signed-off-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260428-03-k3-pwm-drv-v2-2-a532bbe45556@kernel.org Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-26pwm: ipq: Add missing module descriptionRosen Penev
Add a MODULE_DESCRIPTION() entry to fix the modpost warning: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/pwm/pwm-ipq.o Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Fixes: 728796fc4193 ("pwm: Driver for qualcomm ipq6018 pwm block") Link: https://patch.msgid.link/20260509023609.1007698-1-rosenp@gmail.com Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-26pwm: stm32: Make use of mul_u64_u64_div_u64_roundup()Uwe Kleine-König
When the driver was converted to the waveform API the need for this function arised but at that time this function didn't exist yet. In the meantime it's available, so switch to the global function and drop the driver specific implementation. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/788319f0fff963feca4df3c5fcdd471dcf70ccdf.1776264104.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-26pwm: Consistently define pci_device_ids using named initializersUwe Kleine-König (The Capable Hub)
The .driver_data member in the various struct pci_device_id arrays were initialized by list expressions. This isn't easily readable if you're not into PCI. Using named initializers is more explicit and thus easier to parse. The secret plan is to make struct pci_device_id::driver_data an anonymous union (similar to https://lore.kernel.org/all/cover.1776579304.git.u.kleine-koenig@baylibre.com/) and that requires named initializers. But it's also a nice cleanup on its own. This change doesn't introduce changes to the compiled pci_device_id arrays. Tested on x86 and arm64. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20260504085535.1914668-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-26pwm: Driver for qualcomm ipq6018 pwm blockDevi Priya
Driver for the PWM block in Qualcomm IPQ6018 line of SoCs. Based on driver from downstream Codeaurora kernel tree. Removed support for older (V1) variants because I have no access to that hardware. Tested on IPQ5018 and IPQ6010 based hardware. Co-developed-by: Baruch Siach <baruch.siach@siklu.com> Signed-off-by: Baruch Siach <baruch.siach@siklu.com> Signed-off-by: Devi Priya <quic_devipriy@quicinc.com> Reviewed-by: Bjorn Andersson <andersson@kernel.org> Signed-off-by: George Moussalem <george.moussalem@outlook.com> Link: https://patch.msgid.link/20260406-ipq-pwm-v21-2-6ed1e868e4c2@outlook.com [ukleinek: Fixed a few nitpicks as agreed on the mailing list] Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-26irqchip/riscv-imsic: Add nr_guest_files in per-HART local configGuo Ren (Alibaba DAMO Academy)
Add nr_guest_files in per-HART local config to represent the number of guest files available on a particular HART whereas the nr_guest_files in the global config represents the number of guest files available across all HARTs. This allows KVM RISC-V to use nr_guest_files from per-HART local config for asymmetric big.Little systems. Signed-off-by: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org> Acked-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260525094945.3721783-2-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-25clk: socfpga: agilex: implement l3_main_free_clkAdrian Ng Ho Yin
The AGILEX_L3_MAIN_FREE_CLK is defined in the dt-bindings header but was never implemented in the clock driver. Per the Agilex TRM, l3_main_free_clk has no divider or mux and is a fixed 1:1 derivative of noc_free_clk that clocks most of the interconnect datapath. Signed-off-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@altera.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2026-05-26Merge tag 'exynos-drm-next-for-v7.2' of ↵Dave Airlie
git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next New feature and cleanup for Exynos fbdev - Move fbdev emulation to DRM client buffers . Reuses standard ADDFB2/GEM paths and simplifies cleanup. - Use DRM format helpers for geometry and size . Applies 4CC-based format/pitch/size calculation with stronger checks and PAGE_SIZE alignment. . Sets screen_size and fix.smem_len from actual allocated size. Exynos DRM internal cleanup - Adopt DRM core DMA tracking and drop redundant code . Removes private DMA tracking, exynos_drm_gem_prime_import(), and obsolete iommu_dma_init_domain() stub. - Reduce duplication and tighten local scope . Replaces MAX_FB_BUFFER with DRM_FORMAT_MAX_PLANES. . Drops redundant exynos_drm_gem.size and internalizes local-only helpers. Bug fix for Exynos fbdev behavior - Fix screen_buffer offset handling . Keeps screen_buffer at framebuffer base and avoids applying scanout offset. . Includes Fixes and stable Cc for backporting. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Inki Dae <inki.dae@samsung.com> Link: https://patch.msgid.link/20260521143624.56906-1-inki.dae@samsung.com
2026-05-26Merge tag 'mediatek-drm-next-20260521' of ↵Dave Airlie
https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-next Mediatek DRM Next - 20260521 1. hdmi: Convert DRM_ERROR() to drm_err() 2. Simplify mtk_crtc allocation 3. mtk_dpi: Open-code drm_simple_encoder_init() 4. Convert legacy DRM logging to drm_* helpers in mtk_dsi.c 5. dsi: Add compatible for mt8167-dsi Signed-off-by: Dave Airlie <airlied@redhat.com> From: Chun-Kuang Hu <chunkuang.hu@kernel.org> Link: https://patch.msgid.link/20260521140841.5103-1-chunkuang.hu@kernel.org
2026-05-26Merge tag 'drm-xe-next-2026-05-21' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Driver Changes: - drm/xe/oa: Fix exec_queue leak on width check in stream open (Shuicheng Lin) - drm/xe/memirq: Drop cached iosys_map for MEMIRQ status (Michal Wajdeczko) - drm/xe/memirq: Drop cached iosys_map for MEMIRQ mask (Michal Wajdeczko) - drm/xe/memirq: Dump all source pages if MSI-X (Michal Wajdeczko) - drm/xe/memirq: Update diagnostic message (Michal Wajdeczko) - drm/xe/memirq: Reduce buffer size (Michal Wajdeczko) - drm/xe/memirq: Use IRQ page from HW engine definition (Michal Wajdeczko) - drm/xe/memirq: Update GuC initialization and IRQ handler (Michal Wajdeczko) - drm/xe/memirq: Make page layout macros private (Michal Wajdeczko) - drm/xe: Add IRQ page to HW engine definition (Michal Wajdeczko) - drm/xe/guc: Use xe_device_is_l2_flush_optimized() (Gustavo Sousa) - drm/xe/multi_queue: Fix secondary queue error case (Niranjana Vishwanathapura) - drm/xe/reg_sr: Do sanity check for MCR vs non-MCR (Gustavo Sousa) - drm/xe/mcr: Extract reg_in_steering_type_ranges() (Gustavo Sousa) - drm/xe/kunit: Use KUNIT_EXPECT_EQ() in xe_wa_gt() (Gustavo Sousa) - drm/xe: Extract xe_hw_engine_setup_reg_lrc() (Gustavo Sousa) - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4 (Gustavo Sousa) - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1 (Gustavo Sousa) - drm/xe: Define CACHE_MODE_1 as MCR register (Gustavo Sousa) - drm/xe/pf: Fix CFI failure in debugfs access (Mohanram Meenakshisundaram) - drm/xe/vf: Fix signature of print functions (Michal Wajdeczko) - drm/xe: Make drm_driver const (Michal Wajdeczko) - drm/xe/display: Drop xe_display_driver_set_hooks() (Michal Wajdeczko) - drm/xe/display: Add macro with display driver features (Michal Wajdeczko) - drm/xe/display: Add macro with display driver ops (Michal Wajdeczko) - drm/xe/display: Prefer forward declarations (Michal Wajdeczko) - drm/xe/display: Drop xe_display_driver_remove() stub (Michal Wajdeczko) - drm/xe: Drop unused drm/drm_atomic_helper.h include (Michal Wajdeczko) - drm/xe/sriov: Mark NVL as SR-IOV capable (Jakub Kolakowski) - drm/xe/gt_idle: Use NSEC_PER_MSEC instead of float literal (Shuicheng Lin) - drm/xe/gsc: Fix double-free of managed BO in error path (Shuicheng Lin) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/ag9RLujZiYYnSc_F@fedora
2026-05-25eth: dpaa2: constify dpaa2_ethtool_stats and dpaa2_ethtool_extrasLen Bao
The 'dpaa2_ethtool_stats' and 'dpaa2_ethtool_extras' structures are initialized in their declarations and never changed. So, constify them to reduce the attack surface. Before the patch (size dpaa2-ethtool.o): text data bss dec hex 33433 5992 0 39425 9a01 After the patch (size dpaa2-ethtool.o): text data bss dec hex 34937 4488 0 39425 9a01 Signed-off-by: Len Bao <len.bao@gmx.us> Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260523150737.36988-1-len.bao@gmx.us Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net: ibm: emac: Use napi_gro_receive() for Rx packetsRosen Penev
emac_poll_rx() already runs in NAPI context and TAH-equipped EMACs set CHECKSUM_UNNECESSARY on verified frames, which lets GRO coalesce TCP segments without a software checksum on the merge path. Replace the per-poll rx_list batched with netif_receive_skb_list() with direct napi_gro_receive() calls so the stack can merge segments into super-skbs and skip a full traversal per packet -- a meaningful win on the slow 4xx-class CPUs this driver targets. Small routing speed improvement tested on a Cisco Meraki MX60W: Tested with iperf3 Before: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 494 MBytes 414 Mbits/sec 839 sender [ 5] 0.00-10.04 sec 492 MBytes 411 Mbits/sec receiver After: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 510 MBytes 428 Mbits/sec 580 sender [ 5] 0.00-10.04 sec 508 MBytes 424 Mbits/sec receiver Traffic to and from the router seems to be slow no matter what: Tested with iperf3 --bidir Before: [ ID][Role] Interval Transfer Bitrate Retr [ 8][TX-C] 0.00-10.00 sec 297 MBytes 249 Mbits/sec 35 sender [ 8][TX-C] 0.00-10.00 sec 293 MBytes 245 Mbits/sec receiver [ 10][RX-C] 0.00-10.00 sec 184 MBytes 154 Mbits/sec 0 sender [ 10][RX-C] 0.00-10.00 sec 184 MBytes 154 Mbits/sec receiver After: [ ID][Role] Interval Transfer Bitrate Retr [ 8][TX-C] 0.00-10.00 sec 295 MBytes 248 Mbits/sec 31 sender [ 8][TX-C] 0.00-10.00 sec 294 MBytes 246 Mbits/sec receiver [ 10][RX-C] 0.00-10.00 sec 181 MBytes 152 Mbits/sec 0 sender [ 10][RX-C] 0.00-10.00 sec 181 MBytes 152 Mbits/sec receiver Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260521215908.257118-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25devlink: pass param values by pointerRatheesh Kannoth
union devlink_param_value grows substantially once U64 array parameters are added to devlink (from 32 bytes to over 264 bytes). devlink_nl_param_value_fill_one() and devlink_nl_param_value_put() copy the union by value in several places. Passing two instances as value arguments alone consumes over 528 bytes of stack; combined with deeper call chains the parameter stack can approach 800 bytes and trip CONFIG_FRAME_WARN more easily. Switch internal helpers and exported driver APIs to pass pointers to union devlink_param_value rather than passing the union by value. Reviewed-by: Petr Machata <petrm@nvidia.com> # for mlxsw Acked-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Reviewed-by: Arthur Kiyanovski <akiyano@amazon.com> #for ena Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260521095303.2395584-4-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5e: Reduce stack use reading PCIe congestion thresholdsRatheesh Kannoth
union devlink_param_value grew when U64 array parameters were added. Keeping union devlink_param_value val[4] in mlx5e_pcie_cong_get_thresh_config() exceeded the compiler's -Wframe-larger-than limit. Reuse one union: call devl_param_driverinit_value_get() once per MLX5 PCIe congestion threshold and assign each vu16 to the corresponding mlx5e_pcie_cong_thresh member. Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260521095303.2395584-3-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-26Merge tag 'drm-misc-next-2026-05-21' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.2-rc1: UAPI Changes: - Add VIRTIO_GPU_F_BLOB_ALIGNMENT flag. Cross-subsystem Changes: - Add common TMDS character rate constants to video/hdmi and use those in bridge drivers. Core Changes: - Fix leak in drm_syncobj_find_fence. - Fix OOB reads related to DP-MST. - Create drm_get_bridge_by_endpoint and convert drivers to use it in preparation of hotplug. Driver Changes: - Assorted bugfixes and cleanups to accel/ethosu, imagination, virtio, rockchip. - Expandable device heap support to amdxdna, bridge/chipone-icn6211. - Add Surface Pro 12 panels. - Convert ite-it6211 to use drm hdmi audio helpers. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/f4034e3c-8290-49e1-9410-dc1f449265f4@linux.intel.com
2026-05-25net/mlx5: Add SPF function type for page managementMoshe Shemesh
Add MLX5_SPF to enum mlx5_func_type so SPFs get their own page counter, and add the corresponding WARN check at page cleanup. Wait for SPF pages to be reclaimed during ECPF teardown, alongside the existing host PF and VF page waits. SPF page requests are always identified by vhca_id, so the legacy func_id_to_type() path is not reached for satellite PFs. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-13-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Add FDB peer miss rules for satellite PFsMoshe Shemesh
Add satellite PF (SPF) vports to the FDB peer miss rules flow. Introduce mlx5_esw_for_each_spf_vport() macro to iterate SPF vports. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-12-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Support state get/set for satellite PF portsMoshe Shemesh
Extend mlx5_devlink_pf_port_fn_state_get() to support satellite PF vports by querying their vhca_state from the query_esw_functions output using the vport's vhca_id. Extend mlx5_devlink_pf_port_fn_state_set() to support satellite PFs by using the generic mlx5_esw_pf_enable/disable_hca() functions. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-11-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Register SF resource on satellite PF portsOr Har-Toov
Extend port-level resource registration to satellite PF vports. Signed-off-by: Or Har-Toov <ohartoov@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-10-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Register devlink ports for satellite PFsMoshe Shemesh
Include satellite PFs in mlx5_eswitch_is_pf_vf_vport() so they receive the standard PF/VF devlink port operations. Update mlx5_esw_devlink_port_supported() and devlink port attribute setup to register SPF devlink ports with controller number and PF number. Add mlx5_esw_spf_vport_to_idx() to look up the SPF array index by vport number, and mlx5_esw_is_spf_vport() boolean wrapper to identify satellite PF vports. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-9-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Map SF controller to pfnum for satellite PFsMoshe Shemesh
SF devlink port creation and registration used the ECPF's PCI function as pfnum. Extend this to support satellite PF controllers by introducing mlx5_esw_sf_controller_to_pfnum() that maps a controller number to the corresponding PF number, and use it in SF port attribute setup and SF creation validation. Reorder the checks in mlx5_devlink_sf_port_new() so that mlx5_sf_table_supported() runs before attribute validation, since the new helper requires the eswitch to be initialized. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-8-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Expose PF number from query_esw_functionsMoshe Shemesh
Extract pci_device_function from the query_esw_functions output for both the host PF and satellite PFs, storing it alongside the existing host_number field. Add mlx5_esw_get_hpf_pf_num() helper that returns the host PF's actual PCI device function when the new query format is supported, falling back to PCI_FUNC(dev->pdev->devfn) for older firmware. Use it in devlink port attribute setup so that host PF and VF devlink ports report the correct PF number rather than the ECPF's own PCI function number. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-7-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Support SPF SFs in SF hardware tableMoshe Shemesh
Convert the SF hardware table from a fixed-size hwc array to a dynamically allocated one, supporting satellite PF (SPF) SFs alongside local and external host SFs. Initialize hwc entries for each SPF using its host_number as controller. Rename MLX5_SF_HWC_EXTERNAL to MLX5_SF_HWC_EXT_HOST and add MLX5_SF_HWC_FIRST_SPF for clarity. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Initialize satellite PF SF vportsMoshe Shemesh
Extend satellite PF (SPF) initialization to allocate SF vports for each SPF. For each discovered SPF, query its SF capabilities, allocate SF vports, and store the host_number for controller identification. Add accessor APIs mlx5_esw_get_num_spfs(), mlx5_esw_spf_get_host_number(), mlx5_esw_sf_max_spf_functions(), and mlx5_esw_has_spf_sfs() for use by the SF hardware table in a subsequent patch. Also extend mlx5_esw_offloads_controller_valid() to accept SPF controllers in addition to the host PF controller. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Initialize host PF host number earlierMoshe Shemesh
Move host_number from esw->offloads to esw->esw_funcs as hpf_host_number and initialize it during vports_init instead of offloads_enable. This makes the host PF host number available earlier in the initialization sequence, which is required for upcoming SF hardware table support for satellite PFs. Add a mlx5_esw_get_hpf_host_number() accessor to retrieve the stored host number. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Introduce generic helper for PF SFs infoMoshe Shemesh
Introduce mlx5_esw_sf_max_pf_functions() that queries a PF's max_num_sf and sf_base_id using mlx5_vport_get_other_func_general_cap(), which supports both function_id and vhca_id based addressing. Refactor mlx5_esw_sf_max_hpf_functions() into a thin wrapper that adds the host PF precondition checks and calls the new generic helper. Remove mlx5_query_hca_cap_host_pf() as it is not used anymore. This prepares for querying SFs info of Satellite PFs. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Add satellite PF vport supportMoshe Shemesh
Discover satellite PFs from query_esw_functions output and allocate eswitch vports for them. For each satellite PF, create a vport via the CREATE_ESW_VPORT command using its vhca_id and allocate it in the eswitch vport table. When enabling switchdev mode, the ECPF acting as the eswitch manager activates each satellite PF with enable_hca, loads its vport and adds a representor. Since satellite PF devlink ports are registered in a later patch, guard mlx5_esw_offloads_devlink_port() against vports with no devlink port to avoid NULL dereference during representor attach. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>