summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-10-04drm/i915: s/intel_get_linetime_us()/skl_wm_linetime_us()/Ville Syrjälä
Rename intel_get_linetime_us() to skl_wm_linetime_us() to better reflect that it's not meant to be used for anything apart from the watermark calculations. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20250919180838.10498-4-ville.syrjala@linux.intel.com Reviewed-by: Vinod Govindapillai <vinod.govindapillai@intel.com>
2025-10-04drm/i915: Deobfuscate wm linetime calculationVille Syrjälä
intel_get_linetime_us() is a mess. Rewrite it in a straightforward manner. Also the checks for the !active and pixel_rate==0 are completely pointless here since we know that the plane is visible. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20250919180838.10498-3-ville.syrjala@linux.intel.com Reviewed-by: Vinod Govindapillai <vinod.govindapillai@intel.com>
2025-10-04drm/i915: Use the the correct pixel rate to compute wm line timeVille Syrjälä
The line time used for the watermark calculations is supposed to based on the plane's adjusted pixel rate, not the pipe's adjusted pixel rate. The current code will give incorrect answers if plane downscaling is used. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20250919180838.10498-2-ville.syrjala@linux.intel.com Reviewed-by: Vinod Govindapillai <vinod.govindapillai@intel.com>
2025-10-04drm: renesas: rz-du: Drop ARCH_RZG2L dependencyLad Prabhakar
The RZ/G2L DU driver is now also used on other Renesas SoCs such as RZ/V2H(P) and RZ/V2N. Restricting it to ARCH_RZG2L prevents enabling it on these newer platforms. Replace the ARCH_RZG2L dependency with ARCH_RENESAS to allow the driver to be built on all relevant Renesas SoCs. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://lore.kernel.org/r/20251002123452.146610-1-prabhakar.mahadev-lad.rj@bp.renesas.com
2025-10-04i2c: rtl9300: add support for RTL9310 I2C controllerJonas Jelonek
Add support for the internal I2C controllers of RTL9310 series based SoCs to the driver for RTL9300. Add register definitions, chip-specific functions and compatible strings for known RTL9310-based SoCs RTL9311, RTL9312 and RTL9313. Make use of a new device tree property 'realtek,scl' which needs to be specified in case both or only the second master is used. This is required due how the register layout changed in contrast to RTL9300, which has SCL selection in a global register instead of a master-specific one. Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com> Tested-by: Sven Eckelmann <sven@narfation.org> Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz> Tested-by: Markus Stockhausen <markus.stockhausen@gmx.de> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20250927101931.71575-10-jelonek.jonas@gmail.com
2025-10-04i2c: rtl9300: use scoped guard instead of explicit lock/unlockJonas Jelonek
Use the scoped guard infrastructure which unlocks a mutex automatically when the guard goes out of scope, instead of explicit lock and unlock. This simplifies the code and control flow in rtl9300_i2c_smbus_xfer and removes the need of using goto in error cases to unlock before returning. Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com> Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz> Tested-by: Chris Packham <chris.packham@alliedtelesis.co.nz> # On RTL9302C based board Tested-by: Markus Stockhausen <markus.stockhausen@gmx.de> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20250927101931.71575-8-jelonek.jonas@gmail.com
2025-10-04i2c: rtl9300: separate xfer configuration and executionJonas Jelonek
So far, the rtl9300_i2c_smbus_xfer code is quite a mess with function calls distributed over the whole function setting different values in different cases. Calls to rtl9300_i2c_config_xfer and rtl9300_i2c_reg_addr_set are used in every case-block with varying values whose meaning is not instantly obvious. In some cases, there are additional calls within these case-blocks doing more things. This is in general a bad design and especially really bad for readability and maintainability because it distributes changes or issues to multiple locations due to the same function being called with different hardcoded values in different places. To have a good structure, setting different parameters based on the desired operation should not be interleaved with applying these parameters to the hardware registers. Or in different words, the parameter site should be mixed with the call site. Thus, separate configuration and execution of an SMBus xfer within rtl9300_i2c_smbus_xfer to improve readability and maintainability. Add a new 'struct rtl9300_i2c_xfer' to carry the required parameters for an xfer which are configured based on the input parameters within a single switch-case block, without having any function calls within this block. The function calls to actually apply these values to the hardware registers then appear below in a single place and just operate on the passed instance of 'struct rtl9300_i2c_xfer'. These are 'rtl9300_i2c_prepare_xfer' which combines applying all parameters of the xfer to the corresponding register, and 'rtl9300_i2c_do_xfer' which actually executes the xfer and does post-processing if needed. Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com> Tested-by: Sven Eckelmann <sven@narfation.org> Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz> Tested-by: Chris Packham <chris.packham@alliedtelesis.co.nz> # On RTL9302C based board Tested-by: Markus Stockhausen <markus.stockhausen@gmx.de> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20250927101931.71575-7-jelonek.jonas@gmail.com
2025-10-04i2c: rtl9300: do not set read mode on every transferJonas Jelonek
Move the operation to set the read mode from config_xfer to probe. The I2C controller of RTL9300 and RTL9310 support a legacy message mode for READs with 'Read Address Data' instead of the standard format 'Write Address ; Read Data'. There is no way to pass that via smbus_xfer, thus there is no point in supported this in the driver and moreover no point in setting this on every transaction. Setting this once in the probe call is sufficient. Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com> Tested-by: Sven Eckelmann <sven@narfation.org> Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz> Tested-by: Chris Packham <chris.packham@alliedtelesis.co.nz> # On RTL9302C based board Tested-by: Markus Stockhausen <markus.stockhausen@gmx.de> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20250927101931.71575-6-jelonek.jonas@gmail.com
2025-10-04i2c: rtl9300: move setting SCL frequency to config_ioJonas Jelonek
Move the register operation to set the SCL frequency to the rtl9300_i2c_config_io function instead of the rtl9300_i2c_config_xfer function. This rather belongs there next to selecting the current SDA output line. Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com> Tested-by: Sven Eckelmann <sven@narfation.org> Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz> Tested-by: Chris Packham <chris.packham@alliedtelesis.co.nz> # On RTL9302C based board Tested-by: Markus Stockhausen <markus.stockhausen@gmx.de> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20250927101931.71575-5-jelonek.jonas@gmail.com
2025-10-04i2c: rtl9300: rename internal sda_pin to sda_numJonas Jelonek
Rename the internally used 'sda_pin' to 'sda_num' to make it clear that this is NOT the actual pin number of the GPIO pin but rather the logical SDA channel number. Although the alternate function SDA_Y is sometimes given with the GPIO number, this is not always the case. Thus, avoid any confusion or misconfiguration by giving the variable the correct name. This follows the description change in the devicetree bindings. Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com> Tested-by: Sven Eckelmann <sven@narfation.org> Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz> Tested-by: Chris Packham <chris.packham@alliedtelesis.co.nz> # On RTL9302C based board Tested-by: Markus Stockhausen <markus.stockhausen@gmx.de> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20250927101931.71575-4-jelonek.jonas@gmail.com
2025-10-04i2c: rtl9300: use regmap fields and API for registersJonas Jelonek
Adapt the RTL9300 I2C controller driver to use more of the regmap API, especially make use of reg_field and regmap_field instead of macros to represent registers. Most register operations are performed through regmap_field_* API then. Handle SCL selection using separate chip-specific functions since this is already known to differ between the Realtek SoC families in such a way that this cannot be properly handled using just a different reg_field. This makes it easier to add support for newer generations or to handle differences between specific revisions within a series. Just by defining a separate driver data structure with the corresponding register field definitions and linking it to a new compatible. Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com> Tested-by: Sven Eckelmann <sven@narfation.org> Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz> Tested-by: Chris Packham <chris.packham@alliedtelesis.co.nz> # On RTL9302C based board Tested-by: Markus Stockhausen <markus.stockhausen@gmx.de> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20250927101931.71575-2-jelonek.jonas@gmail.com
2025-10-04i2c: rtl9300: Implement I2C block read and writeHarshal Gohel
It was noticed that the original implementation of SMBus Block Write in the driver was actually an I2C Block Write. Both differ only in the Count byte before the actual data: S Addr Wr [A] Comm [A] Count [A] Data [A] Data [A] ... [A] Data [A] P The I2C Block Write is just skipping this Count byte and starts directly with the data: S Addr Wr [A] Comm [A] Data [A] Data [A] ... [A] Data [A] P The I2C controller of RTL93xx doesn't handle this Count byte special and it is simply another one of (16 possible) data bytes. Adding support for the I2C Block Write therefore only requires skipping the count byte (0) in data->block. It is similar for reads. The SMBUS Block read is having a Count byte before the data: S Addr Wr [A] Comm [A] Sr Addr Rd [A] [Count] A [Data] A [Data] A ... A [Data] NA P And the I2C Block Read is directly starting with the actual data: S Addr Wr [A] Comm [A] Sr Addr Rd [A] [Data] A [Data] A ... A [Data] NA P The I2C controller is also not handling this byte in a special way. It simply provides every byte after the Rd marker + Ack as part of the 16 byte receive buffer (registers). The content of this buffer just has to be copied to the right position in the receive data->block. Signed-off-by: Harshal Gohel <hg@simonwunderlich.de> Co-developed-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Sven Eckelmann <sven@narfation.org> Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz> Tested-by: Chris Packham <chris.packham@alliedtelesis.co.nz> Reviewed-by: Jonas Jelonek <jelonek.jonas@gmail.com> Tested-by: Jonas Jelonek <jelonek.jonas@gmail.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/all/20250927-i2c-rtl9300-multi-byte-v7-2-c0fd0e78b818@narfation.org
2025-10-03Revert "drm/xe/vf: Fixup CTB send buffer messages after migration"Matthew Brost
This reverts commit cef88d1265cac7d415606af73ba58926fd3cd8b7. Due to change in the VF migration recovery design this code is not needed any more. v3: - Add commit message (Michal / Lucas) Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://lore.kernel.org/r/20251002233824.203417-4-michal.wajdeczko@intel.com
2025-10-03Revert "drm/xe/vf: Post migration, repopulate ring area for pending request"Matthew Brost
This reverts commit a0dda25d24e636df5c30a9370464b7cebc709faf. Due to change in the VF migration recovery design this code is not needed any more. v3: - Add commit message (Michal / Lucas) Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://lore.kernel.org/r/20251002233824.203417-3-michal.wajdeczko@intel.com
2025-10-03Revert "drm/xe/vf: Rebase exec queue parallel commands during migration ↵Matthew Brost
recovery" This reverts commit ba180a362128cb71d16c3f0ce6645448011d2607. Due to change in the VF migration recovery design this code is not needed any more. v3: - Add commit message (Michal / Lucas) Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://lore.kernel.org/r/20251002233824.203417-2-michal.wajdeczko@intel.com
2025-10-03Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsiLinus Torvalds
Pull SCSI updates from James Bottomley: "Usual driver updates (ufs, mpi3mr, lpfc, pm80xx, mpt3sas) plus assorted cleanups and fixes. The only core update is to sd.c and is mostly cosmetic" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (105 commits) scsi: MAINTAINERS: Update FC element owners scsi: mpt3sas: Update driver version to 54.100.00.00 scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate scsi: mpt3sas: Suppress unnecessary IOCLogInfo on CONFIG_INVALID_PAGE scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() scsi: ufs: ufs-qcom: Add support for limiting HS gear and rate scsi: ufs: pltfrm: Add DT support to limit HS gear and gear rate scsi: ufs: ufs-qcom: Remove redundant re-assignment to hs_rate scsi: ufs: dt-bindings: Document gear and rate limit properties scsi: ufs: core: Fix data race in CPU latency PM QoS request handling scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() scsi: storvsc: Remove redundant ternary operators scsi: ufs: core: Change MCQ interrupt enable flow scsi: smartpqi: Replace kmalloc() + copy_from_user() with memdup_user() scsi: hpsa: Replace kmalloc() + copy_from_user() with memdup_user() scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() scsi: lpfc: Copyright updates for 14.4.0.11 patches scsi: lpfc: Update lpfc version to 14.4.0.11 scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int scsi: lpfc: Clean up extraneous phba dentries ...
2025-10-03Merge tag 'for-6.18/dm-changes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mikulas Patocka: - a new dm-pcache target for read/write caching on persistent memory - fix typos in docs - misc small refactoring - mark dm-error with DM_TARGET_PASSES_INTEGRITY - dm-request-based: fix NULL pointer dereference and quiesce_depth out of sync - dm-linear: optimize REQ_PREFLUSH - dm-vdo: return error on corrupted metadata - dm-integrity: support asynchronous hash interface * tag 'for-6.18/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (27 commits) dm raid: use proper md_ro_state enumerators dm-integrity: prefer synchronous hash interface dm-integrity: enable asynchronous hash interface dm-integrity: rename internal_hash dm-integrity: add the "offset" argument dm-integrity: allocate the recalculate buffer with kmalloc dm-integrity: introduce integrity_kmap and integrity_kunmap dm-integrity: replace bvec_kmap_local with kmap_local_page dm-integrity: use internal variable for digestsize dm vdo: return error on corrupted metadata in start_restoring_volume functions dm vdo: Update code to use mem_is_zero dm: optimize REQ_PREFLUSH with data when using the linear target dm-pcache: use int type to store negative error codes dm: fix "writen"->"written" dm-pcache: cleanup: fix coding style report by checkpatch.pl dm-pcache: remove ctrl_lock for pcache_cache_segment dm: fix NULL pointer dereference in __dm_suspend() dm: fix queue start/stop imbalance under suspend/load/resume races dm-pcache: add persistent cache target in device-mapper dm error: mark as DM_TARGET_PASSES_INTEGRITY ...
2025-10-03Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds
Pull rdma updates from Jason Gunthorpe: "A new Pensando ionic driver, a new Gen 3 HW support for Intel irdma, and lots of small bnxt_re improvements. - Small bug fixes and improves to hfi1, efa, mlx5, erdma, rdmarvt, siw - Allow userspace access to IB service records through the rdmacm - Optimize dma mapping for erdma - Fix shutdown of the GSI QP in mana - Support relaxed ordering MR and fix a corruption bug with mlx5 DMA Data Direct - Many improvement to bnxt_re: - Debugging features and counters - Improve performance of some commands - Change flow_label reporting in completions - Mirror vnic - RDMA flow support - New RDMA driver for Pensando Ethernet devices: ionic - Gen 3 hardware support for the Intel irdma driver - Fix rdma routing resolution with VRFs" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (85 commits) RDMA/ionic: Fix memory leak of admin q_wr RDMA/siw: Always report immediate post SQ errors RDMA/bnxt_re: improve clarity in ALLOC_PAGE handler RDMA/irdma: Remove unused struct irdma_cq fields RDMA/irdma: Fix positive vs negative error codes in irdma_post_send() RDMA/bnxt_re: Remove non-statistics counters from hw_counters RDMA/bnxt_re: Add debugfs info entry for device and resource information RDMA/bnxt_re: Fix incorrect errno used in function comments RDMA: Use %pe format specifier for error pointers RDMA/ionic: Use ether_addr_copy instead of memcpy RDMA/ionic: Fix build failure on SPARC due to xchg() operand size RDMA/rxe: Fix race in do_task() when draining IB/sa: Fix sa_local_svc_timeout_ms read race IB/ipoib: Ignore L3 master device RDMA/core: Use route entry flag to decide on loopback traffic RDMA/core: Resolve MAC of next-hop device without ARP support RDMA/core: Squash a single user static function RDMA/irdma: Update Kconfig RDMA/irdma: Extend CQE Error and Flush Handling for GEN3 Devices RDMA/irdma: Add Atomic Operations support ...
2025-10-03Merge tag 'for-linus-iommufd' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd updates from Jason Gunthorpe: "Two minor fixes: - Make the selftest work again on x86 platforms with iommus enabled - Fix a compiler warning in the userspace kselftest" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Register iommufd mock devices with fwspec iommu/selftest: prevent use of uninitialized variable
2025-10-03Merge tag 'for-linus-fwctl' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl Pull fwctl updates from Jason Gunthorpe: - Fix mismatched kvalloc() kfree() on error paths - Remove NOP dev_err_probe(), shouldn't print on error paths anyhow - For mlx5 permit: MLX5_CMD_OP_MODIFY_CONG_STATUS MLX5_CMD_OP_QUERY_ADJACENT_FUNCTIONS_ID MLX5_CMD_OP_DELEGATE_VHCA_MANAGEMENT MLX5_CMD_OP_QUERY_DELEGATED_VHCA - Use memdup_user in pds * tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl: pds_fwctl: Replace kzalloc + copy_from_user with memdup_user in pdsfc_fw_rpc fwctl/mlx5: Add Adjacent function query commands and their scope fwctl/mlx5: Allow MODIFY_CONG_STATUS command pds_fwctl: Remove the use of dev_err_probe() fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc()
2025-10-03Merge tag 'iommu-updates-v6.18' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu updates from Joerg Roedel: - Inte VT-d: - IOMMU driver updated to the latest VT-d specification - Don't enable PRS if PDS isn't supported - Replace snprintf with scnprintf - Fix legacy mode page table dump through debugfs - Miscellaneous cleanups - AMD-Vi: - Support kdump boot when SNP is enabled - Apple-DART: - 4-level page-table support - RISC-V IOMMU: - ACPI support - Small number of miscellaneous cleanups and fixes * tag 'iommu-updates-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (22 commits) iommu/vt-d: Disallow dirty tracking if incoherent page walk iommu/vt-d: debugfs: Avoid dumping context command register iommu/vt-d: Removal of Advanced Fault Logging iommu/vt-d: PRS isn't usable if PDS isn't supported iommu/vt-d: Remove LPIG from page group response descriptor iommu/vt-d: Drop unused cap_super_offset() iommu/vt-d: debugfs: Fix legacy mode page table dump logic iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() iommu/io-pgtable-dart: Fix off by one error in table index check iommu/riscv: Add ACPI support ACPI: scan: Add support for RISC-V in acpi_iommu_configure_id() ACPI: RISC-V: Add support for RIMT iommu/omap: Use int type to store negative error codes iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs iommu/amd: Skip enabling command/event buffers for kdump crypto: ccp: Skip SEV and SNP INIT for kdump boot iommu/amd: Reuse device table for kdump iommu/amd: Add support to remap/unmap IOMMU buffers for kdump iommu/apple-dart: Add 4-level page table support iommu/io-pgtable-dart: Add 4-level page table support ...
2025-10-04fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-boundsAlbin Babu Varghese
Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes. Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 Suggested-by: Helge Deller <deller@gmx.de> Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2025-10-03Merge tag 'dma-mapping-6.18-2025-09-30' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping updates from Marek Szyprowski: - Refactoring of DMA mapping API to physical addresses as the primary interface instead of page+offset parameters This gets much closer to Matthew Wilcox's long term wish for struct-pageless IO to cacheable DRAM and is supporting memdesc project which seeks to substantially transform how struct page works. An advantage of this approach is the possibility of introducing DMA_ATTR_MMIO, which covers existing 'dma_map_resource' flow in the common paths, what in turn lets to use recently introduced dma_iova_link() API to map PCI P2P MMIO without creating struct page Developped by Leon Romanovsky and Jason Gunthorpe - Minor clean-up by Petr Tesarik and Qianfeng Rong * tag 'dma-mapping-6.18-2025-09-30' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: kmsan: fix missed kmsan_handle_dma() signature conversion mm/hmm: properly take MMIO path mm/hmm: migrate to physical address-based DMA mapping API dma-mapping: export new dma_*map_phys() interface xen: swiotlb: Open code map_resource callback dma-mapping: implement DMA_ATTR_MMIO for dma_(un)map_page_attrs() kmsan: convert kmsan_handle_dma to use physical addresses dma-mapping: convert dma_direct_*map_page to be phys_addr_t based iommu/dma: implement DMA_ATTR_MMIO for iommu_dma_(un)map_phys() iommu/dma: rename iommu_dma_*map_page to iommu_dma_*map_phys dma-mapping: rename trace_dma_*map_page to trace_dma_*map_phys dma-debug: refactor to use physical addresses for page mapping iommu/dma: implement DMA_ATTR_MMIO for dma_iova_link(). dma-mapping: introduce new DMA attribute to indicate MMIO memory swiotlb: Remove redundant __GFP_NOWARN dma-direct: clean up the logic in __dma_direct_alloc_pages()
2025-10-03drivers/base: move memory_block_add_nid() into the callerHannes Reinecke
Now the node id only needs to be set for early memory, so move memory_block_add_nid() into the caller and rename it into memory_block_add_nid_early(). This allows us to further simplify the code by dropping the 'context' argument to do_register_memory_block_under_node(). Link: https://lkml.kernel.org/r/20250729064637.51662-4-hare@kernel.org Suggested-by: David Hildenbrand <david@redhat.com> Signed-off-by: Hannes Reinecke <hare@kernel.org> Acked-by: David Hildenbrand <david@redhat.com> Acked-by: Oscar Salvador <osalvador@suse.de> Reviewed-by: Donet Tom <donettom@linux.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-10-03mm/memory_hotplug: activate node before adding new memory blocksHannes Reinecke
The sysfs attributes for memory blocks require the node ID to be set and initialized, so move the node activation before adding new memory blocks. This also has the nice side effect that the BUG_ON() can be converted into a WARN_ON() as we now can handle registration errors. Link: https://lkml.kernel.org/r/20250729064637.51662-3-hare@kernel.org Fixes: b9ff036082cd ("mm/memory_hotplug.c: make add_memory_resource use __try_online_node") Signed-off-by: Hannes Reinecke <hare@kernel.org> Acked-by: David Hildenbrand <david@redhat.com> Acked-by: Oscar Salvador <osalvador@suse.de> Reviewed-by: Donet Tom <donettom@linux.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-10-03drivers/base/memory: add node id parameter to add_memory_block()Hannes Reinecke
Patch series "mm/memory_hotplug: fixup crash during uevent handling", v4. we have some udev rules trying to read the sysfs attribute 'valid_zones' during an memory 'add' event, causing a crash in zone_for_pfn_range(). Debugging found that mem->nid was set to NUMA_NO_NODE, which crashed in NODE_DATA(nid). Further analysis revealed that we're running into a race with udev event processing: add_memory_resource() has this function calls: 1) __try_online_node() 2) arch_add_memory() 3) create_memory_block_devices() -> calls device_register() -> memory 'add' event 4) node_set_online()/__register_one_node() -> calls device_register() -> node 'add' event 5) register_memory_blocks_under_node() -> sets mem->nid Which, to the uninitated, is ... weird ... Why do we try to online the node in 1), but only register the node in 4) _after_ we have created the memory blocks in 3) ? And why do we set the 'nid' value in 5), when the uevent (which might need to see the correct 'nid' value) is sent out in 3) ? There must be a reason, I'm sure ... So here's a small patchset to fixup uevent ordering. The first patch adds a 'nid' parameter to add_memory_blocks() (to avoid mem->nid being initialized with NUMA_NO_NODE), and the second patch reshuffles the code in add_memory_resource() to fully initialize the node prior to calling create_memory_block_devices() so that the node is valid at that time and uevent processing will see correct values in sysfs. This patch (of 3): We have some udev rules trying to read the sysfs attribute 'valid_zones' during an memory 'add' event, causing a crash in zone_for_pfn_range(). Debugging found that mem->nid was set to NUMA_NO_NODE, which crashed in NODE_DATA(nid). Further analysis revealed that we're running into a race with udev event processing: add_memory_resource() has this function calls: 1) __try_online_node() 2) arch_add_memory() 3) create_memory_block_devices() -> calls device_register() -> memory 'add' event 4) node_set_online()/__register_one_node() -> calls device_register() -> node 'add' event 5) register_memory_blocks_under_node() -> sets mem->nid Which, to the uninitated, is ... weird ... Why do we try to online the node in 1), but only register the node in 4) _after_ we have created the memory blocks in 3) ? And why do we set the 'nid' value in 5), when the uevent (which might need to see the correct 'nid' value) is sent out in 3) ? There must be a reason, I'm sure ... So here's a small patchset to fixup uevent ordering. The first patch adds a 'nid' parameter to add_memory_blocks() (to avoid mem->nid being initialized with NUMA_NO_NODE), and the second patch reshuffles the code in add_memory_resource() to fully initialize the node prior to calling create_memory_block_devices() so that the node is valid at that time and uevent processing will see correct values in sysfs. This patch (of 3): Add a 'nid' parameter to add_memory_block() to initialize the memory block with the correct node id. Link: https://lkml.kernel.org/r/20250729064637.51662-1-hare@kernel.org Link: https://lkml.kernel.org/r/20250729064637.51662-2-hare@kernel.org Signed-off-by: Hannes Reinecke <hare@kernel.org> Acked-by: David Hildenbrand <david@redhat.com> Acked-by: Oscar Salvador <osalvador@suse.de> Reviewed-by: Donet Tom <donettom@linux.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-10-03drm/xe/i2c: Don't rely on d3cold.allowed flag in system PM pathRaag Jadav
In S3 and above sleep states, the device can loose power regardless of d3cold.allowed flag. Bring up I2C controller explicitly in system PM path to ensure its normal operation after losing power. v2: Cover S3 and above states (Rodrigo) Fixes: 0ea07b69517a ("drm/xe/pm: Wire up suspend/resume for I2C controller") Signed-off-by: Raag Jadav <raag.jadav@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://lore.kernel.org/r/20250918103200.2952576-1-raag.jadav@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> (cherry picked from commit e4863f1159befcd70df24fcb5458afaf2feab043) Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
2025-10-03drm/xe/hw_engine_group: Fix double write lock release in error pathShuicheng Lin
In xe_hw_engine_group_get_mode(), a write lock is acquired before calling switch_mode(), which in turn invokes xe_hw_engine_group_suspend_faulting_lr_jobs(). On failure inside xe_hw_engine_group_suspend_faulting_lr_jobs(), the write lock is released there, and then again in xe_hw_engine_group_get_mode(), leading to a double release. Fix this by keeping both acquire and release operation in xe_hw_engine_group_get_mode(). Fixes: 770bd1d34113 ("drm/xe/hw_engine_group: Ensure safe transition between execution modes") Cc: Francois Dugast <francois.dugast@intel.com> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com> Reviewed-by: Francois Dugast <francois.dugast@intel.com> Link: https://lore.kernel.org/r/20250925023145.1203004-2-shuicheng.lin@intel.com Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com> (cherry picked from commit 662d98b8b373007fa1b08ba93fee11f6fd3e387c) Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
2025-10-03drm/xe/uapi: loosen used tracking restrictionMatthew Auld
Currently this is hidden behind perfmon_capable() since this is technically an info leak, given that this is a system wide metric. However the granularity reported here is always PAGE_SIZE aligned, which matches what the core kernel is already willing to expose to userspace if querying how many free RAM pages there are on the system, and that doesn't need any special privileges. In addition other drm drivers seem happy to expose this. The motivation here if with oneAPI where they want to use the system wide 'used' reporting here, so not the per-client fdinfo stats. This has also come up with some perf overlay applications wanting this information. Fixes: 1105ac15d2a1 ("drm/xe/uapi: restrict system wide accounting") Signed-off-by: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Joshua Santosh <joshua.santosh.ranjan@intel.com> Cc: José Roberto de Souza <jose.souza@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: <stable@vger.kernel.org> # v6.8+ Acked-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com> Link: https://lore.kernel.org/r/20250919122052.420979-2-matthew.auld@intel.com (cherry picked from commit 4d0b035fd6dae8ee48e9c928b10f14877e595356) Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
2025-10-03PM: runtime: Fix error checking for kunit_device_register()Dan Carpenter
The kunit_device_register() function never returns NULL, it returns error pointers. Update the assertions to use KUNIT_ASSERT_NOT_ERR_OR_NULL() instead of checking for NULL. Fixes: 7f7acd193ba8 ("PM: runtime: Add basic kunit tests for API contracts") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-10-03Merge tag 'pull-fs_context' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull fs_context updates from Al Viro: "Change vfs_parse_fs_string() calling conventions Get rid of the length argument (almost all callers pass strlen() of the string argument there), add vfs_parse_fs_qstr() for the cases that do want separate length" * tag 'pull-fs_context' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: do_nfs4_mount(): switch to vfs_parse_fs_string() change the calling conventions for vfs_parse_fs_string()
2025-10-03net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()Dan Carpenter
Print "entry->mac" before freeing "entry". The "entry" pointer is freed with kfree_rcu() so it's unlikely that we would trigger this in real life, but it's safer to re-order it. Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-03net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in ↵Bhanu Seshu Kumar Valluri
lan78xx_read_raw_eeprom Syzbot reported read of uninitialized variable BUG with following call stack. lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): EEPROM read operation timeout ===================================================== BUG: KMSAN: uninit-value in lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] BUG: KMSAN: uninit-value in lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] BUG: KMSAN: uninit-value in lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766 lan78xx_probe+0x225c/0x3310 drivers/net/usb/lan78xx.c:4707 Local variable sig.i.i created at: lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1092 [inline] lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] lan78xx_reset+0x77e/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766 The function lan78xx_read_raw_eeprom failed to properly propagate EEPROM read timeout errors (-ETIMEDOUT). In the fallthrough path, it first attempted to restore the pin configuration for LED outputs and then returned only the status of that restore operation, discarding the original timeout error. As a result, callers could mistakenly treat the data buffer as valid even though the EEPROM read had actually timed out with no data or partial data. To fix this, handle errors in restoring the LED pin configuration separately. If the restore succeeds, return any prior EEPROM timeout error correctly to the caller. Reported-by: syzbot+62ec8226f01cb4ca19d9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=62ec8226f01cb4ca19d9 Fixes: 8b1b2ca83b20 ("net: usb: lan78xx: Improve error handling in EEPROM and OTP operations") Signed-off-by: Bhanu Seshu Kumar Valluri <bhanuseshukumar@gmail.com> Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de> Link: https://patch.msgid.link/20250930084902.19062-1-bhanuseshukumar@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-03Merge branch 'pci/misc'Bjorn Helgaas
- Fix whitespace issues (Li Jun) - Fix pci_acpi_preserve_config() memory leak (Nirmoy Das) - Add sysfs 'serial_number' file to expose the Device Serial Number (Matthew Wood) * pci/misc: PCI/sysfs: Expose PCI device serial number PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
2025-10-03Merge branch 'pci/controller/xilinx-nwl'Bjorn Helgaas
- Clear bootloader E_ECAM_CONTROL before merging in the new driver value (Jani Nurminen) * pci/controller/xilinx-nwl: PCI: xilinx-nwl: Fix ECAM programming
2025-10-03Merge branch 'pci/controller/xgene'Bjorn Helgaas
* pci/controller/xgene: PCI: xgene-msi: Return negative -EINVAL in xgene_msi_handler_setup()
2025-10-03Merge branch 'pci/controller/tegra'Bjorn Helgaas
- Correct the devm_kcalloc() argument order (Alok Tiwari) - When asserting PERST#, disable the controller instead of mistakenly disabling the PLL twice (Nagarjuna Kristam) - Convert struct tegra_msi mask_lock to raw spinlock to avoid a lock nesting error (Marek Vasut) - Rename 'root_bus' to 'root_port_bus' for clarity (Manivannan Sadhasivam) * pci/controller/tegra: PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
2025-10-03Merge branch 'pci/controller/stm32'Bjorn Helgaas
- Update pinctrl documentation of initial states and use in runtime suspend/resume (Christian Bruel) - Add pinctrl_pm_select_init_state() for use by stm32 driver, which needs it during resume (Christian Bruel) - Add devicetree bindings and drivers for the STMicroelectronics STM32MP25 in host and endpoint modes (Christian Bruel) * pci/controller/stm32: MAINTAINERS: Add entry for ST STM32MP25 PCIe drivers PCI: stm32-ep: Add PCIe Endpoint support for STM32MP25 dt-bindings: PCI: Add STM32MP25 PCIe Endpoint bindings PCI: stm32: Add PCIe host support for STM32MP25 dt-bindings: PCI: Add STM32MP25 PCIe Root Complex bindings pinctrl: Add pinctrl_pm_select_init_state helper function Documentation: pinctrl: Describe PM helper functions for standard states.
2025-10-03Merge branch 'pci/controller/sophgo'Bjorn Helgaas
- Check for existence of struct cdns_pcie.ops before using it to allow Cadence drivers that don't need to supply ops (Chen Wang) - Add DT binding and driver for the Sophgo SG2042 PCIe controller (Chen Wang) * pci/controller/sophgo: PCI: sg2042: Add Sophgo SG2042 PCIe driver PCI: cadence: Check for the existence of cdns_pcie::ops before using it dt-bindings: pci: Add Sophgo SG2042 PCIe host
2025-10-03Merge branch 'pci/controller/rcar-host'Bjorn Helgaas
- Pass the correct IRQ domain to generic_handle_domain_irq() to fix a regression when converting to msi_create_parent_irq_domain() (Claudiu Beznea) - Drop the spinlock protecting the PMSR register; it's no longer required since pci_lock already serializes accesses (Marek Vasut) - Convert struct rcar_msi mask_lock to raw spinlock to avoid a lock nesting error (Marek Vasut) * pci/controller/rcar-host: PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock PCI: rcar-host: Drop PMSR spinlock PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq()
2025-10-03Merge branch 'pci/controller/rcar-gen4'Bjorn Helgaas
- Fix a typo that prevented correct PHY initialization (Marek Vasut) - Add a missing 1ms delay after PWR reset assertion as required by the V4H manual (Marek Vasut) - Assure reset has completed before DBI access to avoid SError (Marek Vasut) - Fix inverted PHY initialization check, which sometimes led to timeouts and failure to start the controller (Marek Vasut) * pci/controller/rcar-gen4: PCI: rcar-gen4: Fix inverted break condition in PHY initialization PCI: rcar-gen4: Assure reset occurs before DBI access PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion PCI: rcar-gen4: Fix PHY initialization
2025-10-03Merge branch 'pci/controller/qcom'Bjorn Helgaas
- Select PCI Power Control Slot driver so slot voltage rails can be turned on/off if described in Root Port device tree node (Qiang Yu) - Parse only PCI bridge child nodes in device tree, skipping unrelated nodes such as OPP (Operating Performance Points), which caused probe failures (Krishna Chaitanya Chundru) - Add 8.0 GT/s and 32.0 GT/s equalization settings (Ziyue Zhang) - Fix typo in CURSOR macro names (Ziyue Zhang) - Consolidate Root Port 'phy' and 'reset' properties in struct qcom_pcie_port, regardless of whether we got them from the Root Port node or the host bridge node (Manivannan Sadhasivam) - Fetch and map the ELBI register space in the DWC core rather than in each driver individually (Krishna Chaitanya Chundru) - Enable ECAM mechanism in DWC core by setting up iATU with 'CFG Shift Feature' and use this in the qcom driver (Krishna Chaitanya Chundru) * pci/controller/qcom: PCI: dwc: Support ECAM mechanism by enabling iATU 'CFG Shift Feature' PCI: qcom: Prepare for the DWC ECAM enablement PCI: dwc: Prepare the driver for enabling ECAM mechanism using iATU 'CFG Shift Feature' PCI: dwc: Add support for ELBI resource mapping PCI: qcom: Move host bridge 'phy' and 'reset' pointers to struct qcom_pcie_port PCI: qcom: Fix macro typo for CURSOR PCI: qcom: Add equalization settings for 8.0 GT/s and 32.0 GT/s PCI: qcom: Restrict port parsing only to PCIe bridge child nodes PCI: qcom: Select PCI Power Control Slot driver
2025-10-03Merge branch 'pci/controller/plda'Bjorn Helgaas
- Return -ENOMEM directly instead of using dev_err_probe() (Xichao Zhao) * pci/controller/plda: PCI: plda: Remove dev_err_probe() when the errno is -ENOMEM
2025-10-03Merge branch 'pci/controller/mediatek-gen3'Bjorn Helgaas
- Add optional sys clock ready time setting to avoid sys_clk_rdy signal glitching in MT6991 and MT8196 (AngeloGioacchino Del Regno) - Add DT binding and driver support for MT6991 and MT8196 (AngeloGioacchino Del Regno) * pci/controller/mediatek-gen3: PCI: mediatek-gen3: Add support for MediaTek MT8196 SoC dt-bindings: PCI: mediatek-gen3: Add support for MT6991/MT8196 PCI: mediatek-gen3: Implement sys clock ready time setting
2025-10-03Merge branch 'pci/controller/keystone'Bjorn Helgaas
- Use kcalloc() instead of kzalloc() to avoid potential integer overflow (Qianfeng Rong) - Use devm_request_irq() so 'ks-pcie-error-irq' is freed when driver exits with error (Siddharth Vadapalli) * pci/controller/keystone: PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit PCI: keystone: Use kcalloc() instead of kzalloc()
2025-10-03Merge branch 'pci/controller/j721e'Bjorn Helgaas
- Add MODULE_DEVICE_TABLE() so driver can be autoloaded (Siddharth Vadapalli) - Power controller off before configuring the glue layer so the controller latches the correct values on power-on (Siddharth Vadapalli) - Correct the error message when j721e_pcie_ctrl_init() fails (Alok Tiwari) * pci/controller/j721e: PCI: j721e: Fix incorrect error message in probe() PCI: j721e: Fix programming sequence of "strap" settings PCI: j721e: Fix module autoloading
2025-10-03Merge branch 'pci/controller/imx6'Bjorn Helgaas
- Enable the 3.3V Vaux supply if available so devices can request wakeup with either Beacon or WAKE# (Richard Zhu) * pci/controller/imx6: PCI: imx6: Enable the Vaux supply if available
2025-10-03Merge branch 'pci/controller/hv'Bjorn Helgaas
- Remove unused hv_msi_free() parameter (Nam Cao) * pci/controller/hv: PCI: hv: Remove unused parameter of hv_msi_free()
2025-10-03Merge branch 'pci/controller/dwc-edma'Bjorn Helgaas
- Verify that if DT specifies a single IRQ for all eDMA channels, it is named 'dma' (Niklas Cassel) - Remove qcom edma.nr_irqs initialization, which is redundant since dw_pcie_edma_irq_verify() initializes it based on whether the DT contains 'dma' (single IRQ) or 'dmaX' (multiple IRQs) (Niklas Cassel) * pci/controller/dwc-edma: PCI: qcom-ep: Remove redundant edma.nr_irqs initialization PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
2025-10-03Merge branch 'pci/controller/dwc'Bjorn Helgaas
- Add support for x16 in devicetree 'num-lanes' property (Konrad Dybcio) * pci/controller/dwc: PCI: dwc: Support 16-lane operation