summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-08-12Input: elan_i2c - optimize update speed for IC Type 0x19.Jingle Wu 吳金國
Reduce update time by optimizing the update sequence and removing unnecessary delays. Signed-off-by: jingle.wu@emc.com.tw Link: https://patch.msgid.link/KL1PR01MB5116A253A126179473EDB7ACDCCA2@KL1PR01MB5116.apcprd01.prod.exchangelabs.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-12net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAGSiddharth Vadapalli
On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted using the helper function cppi5_desc_get_tags_ids() which fills in the 16-bit Source Tag into the 'port_id' variable. However, it is only the lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID, while the upper 8-bits are Hardware-Reserved and carry an arbitrary value. With the existing logic, sporadic kernel crash is observed due to the subsequent driver code accessing out-of-bound memory because of an invalid port_id. Hence, fix the port_id extraction logic to use only the lower 8-bits of the Source Tag as the MAC Port ID. Fixes: 93a76530316a ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver") Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Reviewed-by: Chintan Vankar <c-vankar@ti.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260807111738.2055900-1-s-vadapalli@ti.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-12pptp: drop packets received before connectQingfang Deng
pptp_bind() publishes the socket by its local call ID before it is connected, so GRE packets can reach pptp_rcv_core() while PPPOX_CONNECTED is clear. Such packets are queued on sk_receive_queue, but PPTP provides no recvmsg operation and never drains the queue after connect. The packets therefore remain there until socket destruction. Drop such packets immediately instead. Since PPTP no longer queues packets on sk_receive_queue, remove the corresponding destructor purge. Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev> Link: https://patch.msgid.link/20260811074948.345834-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-12ppp: annotate lockless queue empty checkQingfang Deng
ppp_poll() checks whether pf->rq contains a packet without holding the queue lock. skb_peek() requires appropriate locking or a private queue, neither of which applies because ppp_input() can enqueue concurrently. Only queue emptiness is needed, so use skb_queue_empty_lockless() instead. Cc: stable+noautosel@kernel.org # race annotation Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev> Reviewed-by: Breno Leitao <leitao@debian.org. Link: https://patch.msgid.link/20260811060236.322284-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-12net/dibs: Correct freeing of dmb_clientid_arrAlexandra Winter
A dibs device interrupt handler can be active after dibs_dev_del() and may still access dmb_clientid_arr. (UAF) In case of a failure in dibs_dev_add() being called by dibs_lo_dev_probe() dmb_clientid_arr is freed twice (double free). Free dmb_clientid_arr in dibs_dev_release() after last reference is gone. Note that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok for now, because no dmbs can be registered before dibs_dev_add(). Fixes: cc21191b584c ("dibs: Move data path to dibs layer") Cc: stable@vger.kernel.org Co-developed-by: Hidayath Khan <hidayath@linux.ibm.com> Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com> Signed-off-by: Alexandra Winter <wintera@linux.ibm.com> Reviewed-by: Dust Li <dust.li@linux.alibaba.com> Link: https://patch.msgid.link/20260810111432.2334900-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-12RDMA/efa: Add support for 128B admin v2 SQ entryYonatan Nachum
Add the new admin v2 format which is 128B in size and its header extends the v1 header with checksum and payload version. On admin SQ init check if the API version reported by the device supports the admin v2 SQ entry and if so use it. Store the payload offset and max size in the SQ for quick access in admin command execution flow. Using the admin SQ v2 entry implicitly enable the checksum in its header so set it for device to validate against. Link: https://patch.msgid.link/r/20260812121718.2904349-4-ynachum@amazon.com Reviewed-by: Michael Margolin <mrgolin@amazon.com> Reviewed-by: Tom Sela <tomsela@amazon.com> Signed-off-by: Yonatan Nachum <ynachum@amazon.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-08-12RDMA/efa: Generalize the admin SQYonatan Nachum
As preparation for admin v2 entry size which is 128B, generalize the SQ ring to use a generic buffer and use the right offset into it using the configured entry size. This will allow us to choose different entry size on SQ init with minimal changes. Link: https://patch.msgid.link/r/20260812121718.2904349-3-ynachum@amazon.com Reviewed-by: Michael Margolin <mrgolin@amazon.com> Signed-off-by: Yonatan Nachum <ynachum@amazon.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-08-12RDMA/efa: Decouple admin command payload from admin headerYonatan Nachum
Remove aq_common_desc from all EFA admin command descriptors so that command structs represent pure payloads. This allows attaching different headers to the same command by copying the payload into the generic header payload field. The admin header is now constructed in a single place which improves separability. Link: https://patch.msgid.link/r/20260812121718.2904349-2-ynachum@amazon.com Reviewed-by: Daniel Kranzdorf <dkkranzd@amazon.com> Reviewed-by: Michael Margolin <mrgolin@amazon.com> Signed-off-by: Yonatan Nachum <ynachum@amazon.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-08-12PCI/MSI: Enable memory decoding before restoring MSI-X messagesFarhan Ali
The current MSI-X restoration path assumes the Command register Memory bit is enabled when writing MSI-X messages. But it's possible the last saved and restored state of a device may not have the Memory bit enabled, even if a device driver later enables Memory bit and MSI-X. Attempting to access Memory space without Memory bit enabled can lead to Unsupported Request (UR) from the device. Fix this by enabling Memory bit and restore it afterwards. Fixes: 41017f0cac92 ("[PATCH] PCI: MSI(X) save/restore for suspend/resume") Signed-off-by: Farhan Ali <alifm@linux.ibm.com> [bhelgaas: comment] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260805165518.794-6-alifm@linux.ibm.com
2026-08-12PCI: Fail FLR when config space is inaccessibleFarhan Ali
If a device is in an error state, its config space may not be accssible. Add additional check to validate if a device's config space is accessible before doing an FLR reset. Signed-off-by: Farhan Ali <alifm@linux.ibm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com> Link: https://patch.msgid.link/20260805165518.794-5-alifm@linux.ibm.com
2026-08-12PCI: Avoid saving config space state if inaccessibleFarhan Ali
The current reset process saves the device's config space state before reset and restores it afterward. However errors may occur unexpectedly and it may then be impossible to save config space because the device may be inaccessible (e.g. DPC). This results in saving invalid values that get written back to the device during state restoration. With a reset we want to recover/restore the device into a functional state. So avoid saving the state of the config space when the device config space is inaccessible. Signed-off-by: Farhan Ali <alifm@linux.ibm.com> [bhelgaas: comment] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com> Reviewed-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260805165518.794-4-alifm@linux.ibm.com
2026-08-12PCI: Allow per function PCI slots to fix slot reset on s390Farhan Ali
On s390 systems, which use a machine level hypervisor, PCI devices are always accessed through a form of PCI pass-through which fundamentally operates on a per PCI function granularity. This is also reflected in the s390 PCI hotplug driver which creates hotplug slots for individual PCI functions. Its reset_slot() function, which is a wrapper for zpci_hot_reset_device(), thus also resets individual functions. Currently, the pci_create_slot() assigns the same pci_slot object to multifunction devices. This approach worked fine on s390 systems that only exposed virtual functions as individual PCI domains to the operating system. Since commit 44510d6fa0c0 ("s390/pci: Handling multifunctions") s390 supports exposing the topology of multifunction PCI devices by grouping them in a shared PCI domain. This creates a problem when resetting a function through the hotplug driver's slot_reset() interface. When attempting to reset a function through the hotplug driver, the shared slot assignment causes the wrong function to be reset instead of the intended one. It also leaks memory as we do create a pci_slot object for the function, but don't correctly free it in pci_slot_release(). Add a flag for struct pci_slot to allow per function PCI slots for functions managed through a hypervisor, which exposes individual PCI functions while retaining the topology. Since we can use all 8 bits for slot 'number' (for ARI devices), change slot 'number' u16 to account for special values PCI_SLOT_PLACEHOLDER and PCI_SLOT_ALL_DEVICES. Fixes: 44510d6fa0c0 ("s390/pci: Handling multifunctions") Suggested-by: Niklas Schnelle <schnelle@linux.ibm.com> Signed-off-by: Farhan Ali <alifm@linux.ibm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260805165518.794-3-alifm@linux.ibm.com
2026-08-13power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy addressHenrik Grimler
bq27z561 currently uses the AveragePower reg, 0x22, for reading both AveragePower and AvailableEnergy. The technical reference manual does not mention AvailableEnergy, and it does not make sense to read a cumulative, always positive, property like AvailableEnergy from a rate property like AveragePower. Set REG_AE as invalid to fix it. Fixes: 6f24ff97e323 ("power: supply: bq27xxx_battery: Add the BQ27Z561 Battery monitor") Signed-off-by: Henrik Grimler <henrik.grimler@axis.com> Link: https://patch.msgid.link/20260811-bq27z746-v1-5-3a4fa38205cc@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-13power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy addressHenrik Grimler
bq28z610 currently uses the AveragePower reg, 0x22, for reading both AveragePower and AvailableEnergy. The technical reference manual does not mention AvailableEnergy, and it does not make sense to read a cumulative, always positive, property like AvailableEnergy from a rate property like AveragePower. Set REG_AE as invalid to fix it. Fixes: 707d678a5c7c ("power: supply: bq27xxx_battery: Add the BQ28z610 Battery monitor") Signed-off-by: Henrik Grimler <henrik.grimler@axis.com> Link: https://patch.msgid.link/20260811-bq27z746-v1-4-3a4fa38205cc@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-13power: supply: bq27xxx: bq27520g4: fix REG_TTES addressHenrik Grimler
According to the technical reference manual the StandbyTimeToEmpty (TTES) register is at 0x1a, not 0x1c. At 0x1c StateOfHealth instead resides. Fixes: 8835cae5f2ab ("power: supply: bq27xxx: adds specific support for bq27520-g4 revision.") Signed-off-by: Henrik Grimler <henrik.grimler@axis.com> Link: https://patch.msgid.link/20260811-bq27z746-v1-3-3a4fa38205cc@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-13power: supply: max17040: synchronize work cancellation on suspendJianing Li
max17040_work() requeues itself after every poll. cancel_delayed_work() only cancels a pending instance and does not wait for a callback that is already running. If system suspend races with the polling callback, the callback can continue accessing the fuel gauge and requeue itself after the suspend callback returns. Use cancel_delayed_work_sync() to ensure polling is quiesced before suspend completes. Fixes: c6f4a42de60b ("Add MAX17040 Fuel Gauge driver") Cc: stable@vger.kernel.org Signed-off-by: Jianing Li <m13940358460@163.com> Link: https://patch.msgid.link/20260810004701.1683-1-m13940358460@163.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-12power: supply: lp8727: fix use-after-free in lp8727_release_irq()Fan Wu
lp8727_isr_func(), the threaded IRQ handler, is the only caller that arms pchg->work via schedule_delayed_work(). lp8727_release_irq() currently cancels the work before freeing the IRQ, so an IRQ delivered in between can re-arm the work through the threaded handler. After .remove returns the devm layer frees pchg while lp8727_delayed_func() may still run and dereference it. Free the IRQ first so the threaded handler is quiesced and can no longer queue work, then cancel the delayed work to drain the final generation. This issue was found by an in-house static analysis tool. Fixes: d71fda016102 ("lp8727_charger: Clean up the interrupt handler") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Link: https://patch.msgid.link/20260807033520.8551-1-fanwu01@zju.edu.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-12power: supply: bq256xx: drain usb_work before freeing the chargerFan Wu
The USB-PHY notifier queues usb_work, whose handler calls power_supply_changed(bq->charger). The reset devm action only unregisters the notifier and was registered before the power supplies, so devm frees bq->charger on unwind before the action runs; a usb_work still queued can then dereference it. Register the reset action after the power supplies, so it unregisters the notifiers and drains usb_work before the supplies are released. Initialize usb_work and obtain the PHY references before registering the notifiers, so the worker cannot run before the supplies exist. Found by static analysis. Fixes: 32e4978bb920 ("power: supply: bq256xx: Introduce the BQ256XX charger driver") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Link: https://patch.msgid.link/20260804145511.103470-1-fanwu01@zju.edu.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-12power: supply: qcom_battmgr: fix battery chemistry strncmp lengthTingguo Cheng
The battery_chemistry field is a 4-byte array without guaranteed null termination. Using BATTMGR_CHEMISTRY_LEN (4) as the strncmp length for 3-character string literals implicitly requires chemistry[3] == '\0', which may not hold. Use 3 instead to match only the significant bytes. Signed-off-by: Tingguo Cheng <tingguo.cheng@oss.qualcomm.com> Link: https://patch.msgid.link/20260812-fix-qcom-batt-chemistry-strn-v1-1-458545e02641@oss.qualcomm.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-12char: ipmi: use named initializers for acpi_device_idPawel Zalewski (The Capable Hub)
Use a named initializer for the acpi_device_id fields which makes the code more readable and consistent with how lists are initialized in the rest of the kernel code base. Also drop explicitly setting fields to 0 where it is redundant. While we are at it - unify the list terminator to have a single space between the brackets and no trailing comma. Signed-off-by: Pawel Zalewski (The Capable Hub) <pzalewski@thegoodpenguin.co.uk> Message-ID: <20260807-acpi-char-v1-3-742c450254dd@thegoodpenguin.co.uk> Signed-off-by: Corey Minyard <corey@minyard.net>
2026-08-12ipmi: Fix leak in __ipmi_bmc_registerMichail Tatas
In case that ida_alloc(&ipmi_bmc_ida,...) succeeds and then platform_device_register() fails, ipmi_bmc_ida is leaked. Fix by freeing the error path Signed-off-by: Michail Tatas <michail.tatas@gmail.com> Message-ID: <anUK_HOy_pCgvsBm@michalis-linux> Signed-off-by: Corey Minyard <corey@minyard.net>
2026-08-12ipmi: Remove all sysfs files on registration failureYuho Choi
ipmi_add_smi() creates the nr_users and nr_msgs files before trying to create the maintenance_mode file. If that last creation fails, the error path removes only nr_users before dropping the final reference to the interface. Remove nr_msgs as well so no sysfs attribute embedded in the freed interface remains registered. Fixes: 627118470fcc ("ipmi: Add a maintenance mode sysfs file") Cc: stable@vger.kernel.org # 6.18 Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Message-ID: <20260803015550.618808-1-dbgh9129@gmail.com> Signed-off-by: Corey Minyard <corey@minyard.net>
2026-08-12power: supply: bd99954: Drop bad register fieldsMatti Vaittinen
The bd99954 driver creates regmap fields for all the registers. All the fields for VBUS_UCD_FCTRL_SET (extended command 0x33) are accidentally created for VCC_UCD_FCTRL_SET (extended command 0x2b), causing all reads/writes for the fields to access wrong register. Luckily the fields for VBUS_UCD_FCTRL_SET are unused. Taking a look at the data-sheet all the fields in the VBUS_UCD_FCTRL_SET are marked as: "In normal operation, please don’t set these registers" with not much of additional documentation. As the fields are wrong and because there seems to be no users of the fields - it is better to just drop them. This will also decrease the memory footprint. Drop incorrect VBUS_UCD_FCTRL_SET fields. Datasheet: https://fscdn.rohm.com/en/products/databook/datasheet/ic/power/battery_management/bd99954xxx-e.pdf Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Fixes: 0902f8366491 ("power: supply: Support ROHM bd99954 charger") Tested-by: Kalle Niemi <kaleposti@gmail.com> Link: https://patch.msgid.link/758fd430d02286a6f18603a8aecfe443f5ddeb8e.1786356145.git.mazziesaccount@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-12power: supply: bd71828: Do not hide errorsMatti Vaittinen
The bd71828 reports success / continues operation even when some regmap operations fail. This can lead incorrect data to be reported. Return appropriate errors when operations fail. Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Fixes: 5bff79dad20a ("power: supply: Add bd718(15/28/78) charger driver") Tested-by: Kalle Niemi <kaleposti@gmail.com> Link: https://patch.msgid.link/22db56cf35252d2d8f67828a0554e8daac7ae251.1786356145.git.mazziesaccount@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-12power: supply: bd71828: Drop duplicate power-supply propertyMatti Vaittinen
The POWER_SUPPLY_PROP_HEALTH is added into property-array twice. Drop the duplicate property. Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Fixes: 5bff79dad20a ("power: supply: Add bd718(15/28/78) charger driver") Tested-by: Kalle Niemi <kaleposti@gmail.com> Link: https://patch.msgid.link/518283ec9163943fcd1b53ad61fc3025fd346d83.1786356145.git.mazziesaccount@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-12power: supply: bd71828: Fix current directionMatti Vaittinen
Both the current and the average current registers contain same 'direction' -bit to denote the direction of the current. The code reading these registers incorrectly caches the direction read from the first register, and uses it also for the second. Fix this by initializing the direction bit for both register reads. Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Fixes: 5bff79dad20a ("power: supply: Add bd718(15/28/78) charger driver") Tested-by: Andreas Kemnade <andreas@kemnade.info> # Kobo Clara 2e rev B Tested-by: Kalle Niemi <kaleposti@gmail.com> Link: https://patch.msgid.link/22c6816204b3f2a8b50df8171e384937822d195b.1786356145.git.mazziesaccount@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-12power: supply: bd71815: Fix temperature readingMatti Vaittinen
The temperature read from the hardware is never returned to caller. Furthermore, the check for temperature validity is wrong. This yields garbage value to be returned to caller, and also detection of bad values read from hardware to fail. Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Fixes: 5bff79dad20a ("power: supply: Add bd718(15/28/78) charger driver") Tested-by: Kalle Niemi <kaleposti@gmail.com> Link: https://patch.msgid.link/4ae3dfa7fc80372977fd29c837321f96d551bf6f.1786356145.git.mazziesaccount@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-12ixd: add devlink supportAmritha Nambiar
Enable initial support for the devlink interface with the ixd driver. The ixd hardware is a single function PCIe device. So, the PCIe adapter gets its own devlink instance to manage device-wide resources or configuration. $ devlink dev show pci/0000:83:00.6 $ devlink dev info pci/0000:83:00.6 pci/0000:83:00.6: driver ixd serial_number 00-a0-c9-ff-ff-23-45-67 versions: fixed: device.type MEV running: fw.mgmt.api 2.0 Signed-off-by: Amritha Nambiar <amritha.nambiar@intel.com> Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Tested-by: Bharath R <Bharath.r@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12ixd: add the core initializationLarysa Zaremba
As the mailbox is setup, initialize the core. This makes use of the send and receive mailbox message framework for virtchnl communication between the driver and device Control Plane (CP). To start with, driver confirms the virtchnl version with the CP. Once that is done, it requests and gets the required capabilities and resources needed such as max vectors, queues, vports etc. Use a unified way of handling the virtchnl messages, where a single function handles all related memory management and the caller only provides the callbacks to fill the send buffer and to handle the response. Place generic control queue message handling separately to facilitate the addition of protocols other than virtchannel in the future. Co-developed-by: Amritha Nambiar <amritha.nambiar@intel.com> Signed-off-by: Amritha Nambiar <amritha.nambiar@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Tested-by: Bharath R <Bharath.r@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12ixd: add reset checks and initialize the mailboxLarysa Zaremba
At the end of the probe, trigger hard reset, initialize and schedule the after-reset task. If the reset is complete in a pre-determined time, initialize the default mailbox, through which other resources will be negotiated. Co-developed-by: Amritha Nambiar <amritha.nambiar@intel.com> Signed-off-by: Amritha Nambiar <amritha.nambiar@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Bharath R <Bharath.r@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12ixd: add basic driver framework for Intel(R) Control Plane FunctionLarysa Zaremba
Add module register and probe functionality. Add the required support to register IXD PCI driver, as well as probe, remove and shutdown callbacks. Enable the PCI device and request to reserve the memory resources that will be used by the driver. Finally map the BAR0 address space. For now, use devm_kzalloc() to allocate adapter, as it requires the least amount of code. In a later commit, it will be replaced with a devlink alternative. Co-developed-by: Amritha Nambiar <amritha.nambiar@intel.com> Signed-off-by: Amritha Nambiar <amritha.nambiar@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Tested-by: Bharath R <Bharath.r@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12idpf: print a debug message and bail in case of non-event ctlq messageLarysa Zaremba
Unlike previous internal idpf ctlq implementation, libie_cp calls the default message handler for all received messages that do not have a matching xn transaction, not only for VIRTCHNL2_OP_EVENT. This leads to many error messages printing garbage, because the parsing expected a valid event message, but got e.g. a delayed response for a timed-out transaction. The information about timed-out transactions and otherwise unhandleable messages can still be valuable for developers, so print the information with dynamic debug and exit the function, so the following functions can parse valid events in peace. Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Michal Kubiak <michal.kubiak@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12idpf: make mbx_task queueing and cancelling more consistentLarysa Zaremba
One of the assumptions of libie_cp and pre-refactor idpf control queue handling is such that all Rx processing is handled by a single task, which is to be cancelled before the mailbox destruction. Aside from cancelling, it is also important to make sure that idpf_intr_rel() never reschedules it afterwards. In order to comply, in the init path, do the first queueing of mbx_task in idpf_init_dflt_mbx(), and in deinit and reset, always cancel the task in idpf_deinit_dflt_mbx(), in every single flow call idpf_mb_intr_rel_irq() beforehand. Reviewed-by: Emil Tantilov <emil.s.tantilov@intel.com> Reviewed-by: Michal Kubiak <michal.kubiak@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12idpf: refactor idpf to use libie control queuesPavan Kumar Linga
Support to initialize and configure controlqs, and manage their transactions was introduced in libie. As part of it, most of the existing controlq structures are renamed and modified. Use those APIs in idpf and make all the necessary changes. Previously for the send and receive virtchnl messages, there used to be a memcpy involved in controlq code to copy the buffer info passed by the send function into the controlq specific buffers. There was no restriction to use automatic memory in that case. The new implementation in libie removed copying of the send buffer info and introduced DMA mapping of the send buffer itself. To accommodate it, use dynamic memory for the larger send buffers. For smaller ones (<= 128 bytes) libie still can copy them into the pre-allocated message memory. Those changes result in a pretty big diff, but the changes are fairly trivial and localized. In case of receive, idpf receives a page pool buffer allocated by the libie and care should be taken to release it after use in the idpf. idpf_idc_rdma_vc_send_sync() no longer truncates oversized responses or zeroes *recv_len on error, but this was confirmed to have no practical impact for any existing callers. This refactoring introduces roughly additional 40KB of module storage used for systems that only run idpf, so idpf + libie_cp + libie_pci takes about 7% more storage than just idpf before refactoring. We now pre-allocate small TX buffers, so that does increase the memory usage, but reduces the need to allocate. This results in additional 256 * 128B of memory permanently used, increasing the worst-case memory usage by 32KB but our ctlq RX buffers need to be of size 4096B anyway (not changed by the patchset), so this is hardly noticeable. As for the timings, the fact that we are mostly limited by the HW response time which is far from instant, is not changed by this refactor. Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Co-developed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12idpf: refactor idpf to use libie_pci APIsPavan Kumar Linga
Use libie_pci init and MMIO APIs where possible, struct idpf_hw cannot be deleted for now as it also houses control queues that will be refactored later. Memory regions are added and removed in layers, so e.g. mailbox and rstat are added first and not removed until teardown. libie_pci stores the regions in the order of addition, so no new locks/checks are required, despite the data structure change. Use libie_cp header for libie_ctlq_ctx that contains mmio info from the start in order to not increase the diff later. Reviewed-by: Madhu Chittim <madhu.chittim@intel.com> Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Co-developed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12idpf: remove unused code for getting RSS info from deviceLarysa Zaremba
idpf_send_get_set_rss_lut_msg() and idpf_send_get_set_rss_key_msg() do not handle the get=true path properly. Response validation is insufficient, memcpy size is wrong, LE-to-CPU conversion is missing. Fortunately, those functions are never used with get=true. Given how broken this dead code is, it is unlikely to be useful in the future. Rename idpf_send_get_set_rss_lut_msg() to idpf_send_set_rss_lut_msg(), idpf_send_get_set_rss_key_msg() to idpf_send_set_rss_key_msg(), remove the get parameter and remove all get=true cases from the function. Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12idpf: remove 'vport_params_reqd' fieldPavan Kumar Linga
While sending a create vport message to the device control plane, a create vport virtchnl message is prepared with all the required info to initialize the vport. This info is stored in the adapter struct but never used thereafter. So, remove the said field. Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Reviewed-by: Madhu Chittim <madhu.chittim@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12libie: add bookkeeping support for control queue messagesPhani R Burra
Small send control queue message buffers are managed and reused by libie itself, bigger send buffers are consumed. All are tracked with the unique transaction (Xn) ids until they receive response or time out. Responses can be received out of order, therefore transactions are stored in an array and tracked though a bitmap. Rx buffers utilize page_pool. Pre-allocated DMA memory is used where possible. It reduces the driver overhead in handling memory allocation/free and message timeouts. Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Phani R Burra <phani.r.burra@intel.com> Co-developed-by: Victor Raj <victor.raj@intel.com> Signed-off-by: Victor Raj <victor.raj@intel.com> Co-developed-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Bharath R <bharath.r@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Co-developed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12libie: add control queue supportPhani R Burra
Libie will now support control queue setup and configuration APIs. These are mainly used for mailbox communication between drivers and control plane. Make use of the libeth_rx page pool support for managing controlq buffers. Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Phani R Burra <phani.r.burra@intel.com> Co-developed-by: Victor Raj <victor.raj@intel.com> Signed-off-by: Victor Raj <victor.raj@intel.com> Co-developed-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Signed-off-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Co-developed-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Tested-by: Bharath R <bharath.r@intel.com> Co-developed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12libeth: allow to create fill queues without NAPIPavan Kumar Linga
Control queues can utilize libeth_rx fill queues, despite working outside of NAPI context. The only problem is standard fill queues requiring NAPI that provides them with the device pointer. Introduce a way to provide the device directly without using NAPI. Suggested-by: Alexander Lobakin <aleksander.lobakin@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Bharath R <bharath.r@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12libie: add PCI device initialization helpers to libiePhani R Burra
idpf and ixd drivers serve different PCI functions on the same device, therefore their PCI configuration flow is very similar. Add support functions for idpf and ixd to configure PCI functionality and access MMIO space. Add a mapping list which can be traversed by a driver, e.g. to pass certain I/O mappings to the auxbus devices. Such list is also traversed by the libie_pci_get_mmio_addr() helper, which allows for easier memory access. Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Phani R Burra <phani.r.burra@intel.com> Co-developed-by: Victor Raj <victor.raj@intel.com> Signed-off-by: Victor Raj <victor.raj@intel.com> Co-developed-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Signed-off-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Co-developed-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Bharath R <bharath.r@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Co-developed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12virtchnl: move virtchnl and virtchnl2 headers to 'include/linux/net/intel'Victor Raj
virtchnl2 headers will be used by both idpf and ixd drivers, so they have to be moved to an include directory. On top of that, it would be useful to place all iavf headers together with other intel networking headers. Move abovementioned intel header files into 'include/linux/net/intel'. While at it, remove the self-include from iavf_types.h. Suggested-by: Alexander Lobakin <aleksander.lobakin@intel.com> Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Signed-off-by: Victor Raj <victor.raj@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder valueFarhan Ali
Introduce a constant for placeholder value and update the kerneldoc for pci_create_slot() to reference PCI_SLOT_PLACEHOLDER instead of -1 throughout. No functional change. Suggested-by: Bjorn Helgaas <bhelgaas@google.com> Signed-off-by: Farhan Ali <alifm@linux.ibm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Tyrel Datwyler <tyreld@linux.ibm.com> Cc: linuxppc-dev@lists.ozlabs.org Link: https://patch.msgid.link/20260805165518.794-2-alifm@linux.ibm.com
2026-08-12PCI/ASPM: Mask ASPM states based on Devicetree propertiesKrishna Chaitanya Chundru
Some platforms require selectively disabling specific ASPM states on a given PCIe link to avoid link instability or functional failures caused by board-level connectivity constraints such as PCB routing, connectors, slots, or external cabling. Devicetree supports disabling ASPM L0s, L1, and L1 PM Substates via the 'aspm-no-l0s', 'aspm-no-l1' [1], and 'aspm-no-l1ss' [2] properties. However, the ASPM driver does not currently honor these properties when initializing the default link state. When firmware enables L1 PM Substates before the kernel takes over, masking aspm_support alone is insufficient to disable them in hardware. pcie_config_aspm_link() guards L1SS configuration behind a check on aspm_capable, which is derived from aspm_support. Once aspm_support is masked, pcie_config_aspm_l1ss() is never called, leaving firmware-enabled L1SS substates active in hardware. Fix this by introducing pcie_link_has_aspm_override() to check for DT override properties on either endpoint of the link. In pcie_aspm_override_default_link_state(), use it to: - Mask aspm_support, aspm_default, and aspm_enabled for any disabled state, so software's view of the link stays in sync with what is actually programmed in hardware. Leaving aspm_enabled stale would make pcie_aspm_enabled() and the aspm sysfs attributes report a state as active even after it has been masked, and could cause pcie_config_aspm_link()'s "already in requested state" check to skip reprogramming hardware to match. - Explicitly call pcie_config_aspm_l1ss(link, 0) before masking aspm_support when firmware has L1SS active and DT requests disabling L1 or L1SS, since pcie_config_aspm_link() will no longer do so once aspm_capable is derived from the masked aspm_support. Move the aspm_default initialization and pcie_aspm_override_default_link_state() call in pcie_aspm_cap_init() to before the "Restore L0s/L1" block. pcie_aspm_cap_init() disables L1 in hardware prior to aspm_l1ss_init() and re-enables it only in the restore block. Calling pcie_config_aspm_l1ss() while L1 is already disabled satisfies its precondition ("Caller must disable L1 first"), whereas the previous placement after the restore violated it. Since the restore block writes back the parent_lnkctl/child_lnkctl snapshot taken from hardware before the DT override ran, mask the L0s and L1 enable bits out of that snapshot for any state the override has just disabled in aspm_support. Otherwise the restore step would unconditionally reprogram the link back to firmware's original L0s/L1 configuration, defeating the Devicetree override it is meant to enforce. Move pcie_config_aspm_l1ss() earlier in the file so it can be called from pcie_aspm_override_default_link_state(). Link [1]: https://github.com/devicetree-org/dt-schema/pull/188 Link [2]: https://github.com/devicetree-org/dt-schema/pull/190 Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260727-aspm-v6-3-2ebb3ee7ef71@oss.qualcomm.com
2026-08-12PCI/ASPM: Disable/restore ASPM on every function for multi-function devicesKrishna Chaitanya Chundru
pcie_aspm_cap_init() disables ASPM L0s/L1 before touching L1SS config, then restores the pre-existing state afterward. Both steps only ever touched link->downstream, i.e. function 0 of the downstream component, leaving sibling functions (>0) on a multi-function device untouched. This means the "disable" step does not actually disable ASPM link-wide on a multi-function device: a sibling function can still have L1 enabled even after this step runs. PCIe r7.0, sec 7.5.3.7, recommends programming the same ASPM Control value for all functions of a multi-function device, and pcie_config_aspm_link() already loops over every function on the bus for exactly this reason. Loop over every function on linkbus->devices for both the disable and restore steps, keeping the existing sec 7.5.3.7 ordering (disable downstream functions before upstream, restore upstream before downstream functions). The masked pcie_capability_clear_and_set_word() accessor from the previous commit makes this safe: it only ever touches the ASPM Control bits, so function-specific bits elsewhere in LNKCTL (e.g. Read Completion Boundary, CLKREQ Enable) on sibling functions are left untouched. Fixes: 7447990137bf ("PCI/ASPM: Disable L1 before disabling L1 PM Substates") Closes: https://lore.kernel.org/all/20260721143945.86E7D1F000E9@smtp.kernel.org/ Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260727-aspm-v6-2-2ebb3ee7ef71@oss.qualcomm.com
2026-08-12spi: img-spfi: don't disable runtime PM on DMA deferred probeFelix Gu
When dma_request_chan() returns -EPROBE_DEFER, the error path jumps to disable_pm and calls pm_runtime_disable() even though pm_runtime_enable() was never called, leaving disable_depth unbalanced and the device permanently PM-disabled. Route the defer path through free_dma to skip pm_runtime_disable(). Fixes: 6bfbf4d0aa0c ("spi: img-spfi: Use dma_request_chan() instead dma_request_slave_channel()") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Link: https://patch.msgid.link/20260808-spfi-v1-1-6bc4345be430@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-12spi: mtk-nor: Propagate errors from IRQ requestbui duc phuc
Treat a failure from devm_request_irq() as a probe error instead of continuing without an IRQ after only reporting a warning. Return the error through the existing error path to ensure the driver does not continue with an unsuccessfully requested IRQ. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260807102932.45785-2-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-12spi: mtk-nor: Propagate errors from optional IRQ lookupbui duc phuc
platform_get_irq_optional() returns a positive IRQ number on success or a negative error code on failure. For an optional IRQ, -ENXIO indicates that no IRQ is available, while other errors should be propagated. Propagate errors such as -EPROBE_DEFER and -EINVAL instead of continuing probe without the IRQ. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260807102932.45785-1-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-12regmap: sdw-mbq: don't call an unset readable_reg callbackAndrey Golovko
regmap_sdw_mbq_poll_busy() decides whether to poll the Function Busy bit by calling ctx->readable_reg(), which is a straight copy of config->readable_reg. That callback is optional: regmap_readable() treats a NULL ->readable_reg as "every register is readable", and drivers rely on that. es9356 and tac5xx2-sdw both build an MBQ regmap without one. Since commit ca1b11b36d82 ("regmap: sdw-mbq: Allow defers on undeferrable controls") the poll runs on every -ENODATA, not only for Controls the driver marked deferrable, so any of those devices answering COMMAND_IGNORED takes the kernel through a NULL function pointer. Treat a missing callback the way the rest of regmap does and poll. Fixes: 5bc493bf0c37 ("regmap: sdw-mbq: Add support for SDCA deferred controls") Signed-off-by: Andrey Golovko <andrey.golovko@gmail.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260811184500.5312-1-andrey.golovko@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-12regulator: fan53555: Add support for FAN53555BUC23X typeArash Golgol
FAN53555BUC23X has the ID 0 and REV 0xc, starts at 600mV and increments in 12.5mV steps. Per the datasheet, the FAN53555BUC23X (23 option) is grouped with the 00 and 13 options for soft-start timing (t_SS = 300us typ.), so the existing enable_time = 400 is reused here as well. This variant is found on the ASUS Tinker Edge R (RK3399Pro) as the supply regulator for both vdd_gpu and vdd_cpu_b. Verified across the full GPU OPP table with the userspace devfreq governor. Signed-off-by: Arash Golgol <arash.golgol@gmail.com> Link: https://patch.msgid.link/20260812125054.19111-1-arash.golgol@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>