summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-08-13drm/i915/tc: Cache the pin assignment valueImre Deak
Cache the pin assignment value. This is more consistent with the way the max lane count value is tracked and a bit more efficient than reading out the same value from HW each time it's queried. Reviewed-by: Mika Kahola <mika.kahola@intel.com> Link: https://lore.kernel.org/r/20250805073700.642107-19-imre.deak@intel.com Signed-off-by: Imre Deak <imre.deak@intel.com>
2025-08-13dmc/i915/tc: Report pin assignment NONE in TBT-alt modeImre Deak
The pin assignment is only relevant in case the PHY is owned by the display, that is in legacy and DP-alt mode. In TBT-alt mode the PHY is owned by the TBT FW/driver and so the pin assignment/configuration is managed by those components. A follow-up change will cache the pin assignment value in all the TypeC modes - querying this by calling get_pin_assignment() - prepare for that here, by reporting pin assignment NONE in the TBT-alt mode. Reviewed-by: Mika Kahola <mika.kahola@intel.com> Link: https://lore.kernel.org/r/20250805073700.642107-18-imre.deak@intel.com Signed-off-by: Imre Deak <imre.deak@intel.com>
2025-08-13drm/i915/tc: Pass intel_tc_port to internal lane mask/count helpersImre Deak
Pass the intel_tc_port pointer instead of intel_digital_port to all lane mask and count query helpers internal to intel_tc.c, to avoid the redundant intel_digital_port -> intel_tc_port conversions. While at it shorten the function names, keeping the intel_tc_port_ prefix only for exported functions and use the mtl_, icl_ prefixes making it clear which platforms a given query function is specific for. Reviewed-by: Mika Kahola <mika.kahola@intel.com> Link: https://lore.kernel.org/r/20250805073700.642107-17-imre.deak@intel.com Signed-off-by: Imre Deak <imre.deak@intel.com>
2025-08-13drm/i915/tc: Handle non-TC encoders when getting the pin assignmentImre Deak
For consistency, handle the case where intel_tc_port_get_pin_assignment() is called for a non-TypeC encoder, returning the default NONE pin assignment value, similarly to how this is done in intel_tc_port_max_lane_count(). Reviewed-by: Mika Kahola <mika.kahola@intel.com> Link: https://lore.kernel.org/r/20250805073700.642107-16-imre.deak@intel.com Signed-off-by: Imre Deak <imre.deak@intel.com>
2025-08-13drm/i915/tc: Unify the way to get the max lane count value on MTL+Imre Deak
Unify the way to get the max lane count value on all MTL+ platforms, reducing the code duplication. Reviewed-by: Mika Kahola <mika.kahola@intel.com> Link: https://lore.kernel.org/r/20250805073700.642107-15-imre.deak@intel.com Signed-off-by: Imre Deak <imre.deak@intel.com>
2025-08-13drm/i915/tc: Unify the way to get the pin assignment on all platformsImre Deak
Unify the way to get the pin assignment on all platforms. This removes the duplication in the helper functions in this and a follow-up change. Reviewed-by: Mika Kahola <mika.kahola@intel.com> Link: https://lore.kernel.org/r/20250805073700.642107-14-imre.deak@intel.com Signed-off-by: Imre Deak <imre.deak@intel.com>
2025-08-13drm/i915/tc: Validate the pin assignment on all platformsImre Deak
Validate the pin assignment on ICL-TGL, similarly to how this is done on MTL+. ICL supports all the pin assignments, while TGL+ supports only the NONE, C, D, E pin assignments. Reviewed-by: Mika Kahola <mika.kahola@intel.com> Link: https://lore.kernel.org/r/20250805073700.642107-13-imre.deak@intel.com Signed-off-by: Imre Deak <imre.deak@intel.com>
2025-08-13drm/i915/tc: Handle pin assignment NONE on all platformsImre Deak
For consistency, handle pin assignment NONE on all platforms similarly to LNL+. On earlier platforms the driver doesn't actually see this pin assignment - as it's not valid on a connected DP-alt PHY - however it's a valid HW setting even on those platforms, for instance in legacy mode. Handle this pin assignment on earlier platforms as well, so that the way to query the pin assignment can be unified by a follow-up change. Reviewed-by: Mika Kahola <mika.kahola@intel.com> Link: https://lore.kernel.org/r/20250805073700.642107-12-imre.deak@intel.com Signed-off-by: Imre Deak <imre.deak@intel.com>
2025-08-13drm/i915/tc: Pass pin assignment value around using the pin assignment enumImre Deak
Pass around the pin assignment value via the corresponding enum instead of a plain integer. While at it rename intel_tc_port_get_pin_assignment_mask() to intel_tc_port_get_pin_assignment(), since the value returned is not a mask. Reviewed-by: Mika Kahola <mika.kahola@intel.com> Link: https://lore.kernel.org/r/20250805073700.642107-11-imre.deak@intel.com Signed-off-by: Imre Deak <imre.deak@intel.com>
2025-08-13drm/i915/tc: Add an enum for the TypeC pin assignmentImre Deak
Add an enum for the TypeC pin assignment, which is a better way to pass its value around than a plain integer. While at it add a description for each pin assignment, based on the DP and DP Alt mode Standards, opting for more details to ease any future debugging related to a given pin assignment and the cables / sink types used. Reviewed-by: Mika Kahola <mika.kahola@intel.com> [Imre: s/deined/defined in pin assignment enum documentation.] Link: https://lore.kernel.org/r/20250805073700.642107-10-imre.deak@intel.com Signed-off-by: Imre Deak <imre.deak@intel.com>
2025-08-13drm/i915/tc: Move asserting the power state after reading TCSS_DDI_STATUSImre Deak
Move asserting the expected TC cold power state and the read out register value right after reading the TCSS_DDI_STATUS register, similarly to how this is done with the other PORT_TX_DFLEXDPSP and PORT_TX_DFLEXPA1 PHY registers. Reviewed-by: Mika Kahola <mika.kahola@intel.com> Link: https://lore.kernel.org/r/20250805073700.642107-9-imre.deak@intel.com Signed-off-by: Imre Deak <imre.deak@intel.com>
2025-08-13drm/i915/tc: Move getting the power domain before reading DFLEX registersImre Deak
Move getting the required display power domain right before reading the PORT_TX_DFLEXDPSP and PORT_TX_DFLEXPA1 registers, similarly to how this is done while reading the other TCSS_DDI_STATUS PHY register. Reviewed-by: Mika Kahola <mika.kahola@intel.com> Link: https://lore.kernel.org/r/20250805073700.642107-8-imre.deak@intel.com Signed-off-by: Imre Deak <imre.deak@intel.com>
2025-08-13drm/i915/tc: Use the cached max lane count valueImre Deak
Use the PHY's cached max lane count value on all platforms similarly to LNL+. On LNL+ using the cached value is mandatory - since the corresponding HW register field can get cleared by the time the value is queried - on earlier platforms there isn't a problem with using the HW register instead. Having a uniform way to query the value still makes sense and it's also a bit more efficient, so do that. Reviewed-by: Mika Kahola <mika.kahola@intel.com> Link: https://lore.kernel.org/r/20250805073700.642107-7-imre.deak@intel.com Signed-off-by: Imre Deak <imre.deak@intel.com>
2025-08-13HID: intel-thc-hid: Intel-quicki2c: Enhance driver re-install flowEven Xu
After driver module is removed and during re-install stage, if there is continueous user touching on the screen, it is a risk impacting THC hardware initialization which causes driver installation failure. This patch enhances this flow by quiescing the external touch interrupt after driver is removed which keeps THC hardware ignore external interrupt during this remove and re-install stage. Signed-off-by: Even Xu <even.xu@intel.com> Tested-by: Rui Zhang <rui1.zhang@intel.com> Fixes: 66b59bfce6d9 ("HID: intel-thc-hid: intel-quicki2c: Complete THC QuickI2C driver") Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-13spi: spi-qpic-snand: handle 'use_ecc' parameter of qcom_spi_config_cw_read()Gabor Juhos
During raw read, neither the status of the ECC correction nor the erased state of the codeword gets checked by the qcom_spi_read_cw_raw() function, so in case of raw access reading the corresponding registers via DMA is superfluous. Extend the qcom_spi_config_cw_read() function to evaluate the existing (but actually unused) 'use_ecc' parameter, and configure reading only the flash status register when ECC is not used. With the change, the code gets in line with the corresponding part of the config_nand_cw_read() function in the qcom_nandc driver. Signed-off-by: Gabor Juhos <j4g8y7@gmail.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://patch.msgid.link/20250808-qpic-snand-handle-use_ecc-v1-1-67289fbb5e2f@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-13md: add legacy_async_del_gendisk modeXiao Ni
commit 9e59d609763f ("md: call del_gendisk in control path") changes the async way to sync way of calling del_gendisk. But it breaks mdadm --assemble command. The assemble command runs like this: 1. create the array 2. stop the array 3. access the sysfs files after stopping The sync way calls del_gendisk in step 2, so all sysfs files are removed. Now to avoid breaking mdadm assemble command, this patch adds the parameter legacy_async_del_gendisk that can be used to choose which way. The default is async way. In future, we plan to change default to sync way in kernel 7.0. Then users need to upgrade to mdadm 4.5+ which removes step 2. Fixes: 9e59d609763f ("md: call del_gendisk in control path") Reported-by: Mikulas Patocka <mpatocka@redhat.com> Closes: https://lore.kernel.org/linux-raid/CAMw=ZnQ=ET2St-+hnhsuq34rRPnebqcXqP1QqaHW5Bh4aaaZ4g@mail.gmail.com/T/#t Suggested-and-reviewed-by: Yu Kuai <yukuai3@huawei.com> Signed-off-by: Xiao Ni <xni@redhat.com> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Link: https://lore.kernel.org/linux-raid/20250813032929.54978-1-xni@redhat.com Signed-off-by: Yu Kuai <yukuai3@huawei.com>
2025-08-13RDMA/hns: Fix dip entries leak on devices newer than hip09Junxian Huang
DIP algorithm is also supported on devices newer than hip09, so free dip entries too. Fixes: f91696f2f053 ("RDMA/hns: Support congestion control type selection according to the FW") Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com> Link: https://patch.msgid.link/20250812122602.3524602-1-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()Minjong Kim
in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_version() before calling hid_to_usb_dev() Signed-off-by: Minjong Kim <minbell.kim@samsung.com> Link: https://patch.msgid.link/20250813-hid-ntrig-page-fault-fix-v2-1-f98581f35106@samsung.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-08-13IB/hfi1: Use for_each_online_cpu() instead of for_each_cpu()Fushuai Wang
Replace the opencoded for_each_cpu(cpu, cpu_online_mask) loop with the more readable and equivalent for_each_online_cpu(cpu) macro. Signed-off-by: Fushuai Wang <wangfushuai@baidu.com> Link: https://patch.msgid.link/20250811062534.1041-1-wangfushuai@baidu.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/core: Free pfn_list with appropriate kvfree callAkhilesh Patil
Ensure that pfn_list allocated by kvcalloc() is freed using corresponding kvfree() function. Match memory allocation and free routines kvcalloc -> kvfree. Fixes: 259e9bd07c57 ("RDMA/core: Avoid hmm_dma_map_alloc() for virtual DMA devices") Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in> Link: https://patch.msgid.link/aJjcPjL1BVh8QrMN@bhairav-test.ee.iitb.ac.in Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/bnxt_re: Fix to initialize the PBL arrayAnantha Prabhu
memset the PBL page pointer and page map arrays before populating the SGL addresses of the HWQ. Fixes: 0c4dcd602817 ("RDMA/bnxt_re: Refactor hardware queue memory allocation") Signed-off-by: Anantha Prabhu <anantha.prabhu@broadcom.com> Reviewed-by: Saravanan Vajravel <saravanan.vajravel@broadcom.com> Reviewed-by: Selvin Xavier <selvin.xavier@broadcom.com> Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Link: https://patch.msgid.link/20250805101000.233310-5-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/bnxt_re: Fix a possible memory leak in the driverKalesh AP
The GID context reuse logic requires the context memory to be not freed if and when DEL_GID firmware command fails. But, if there's no subsequent ADD_GID to reuse it, the context memory must be freed when the driver is unloaded. Otherwise it leads to a memory leak. Below is the kmemleak trace reported: unreferenced object 0xffff88817a4f34d0 (size 8): comm "insmod", pid 1072504, jiffies 4402561550 hex dump (first 8 bytes): 01 00 00 00 00 00 00 00 ........ backtrace (crc ccaa009e): __kmalloc_cache_noprof+0x33e/0x400 0xffffffffc2db9d48 add_modify_gid+0x5e0/0xb60 [ib_core] __ib_cache_gid_add+0x213/0x350 [ib_core] update_gid+0xf2/0x180 [ib_core] enum_netdev_ipv4_ips+0x3f3/0x690 [ib_core] enum_all_gids_of_dev_cb+0x125/0x1b0 [ib_core] ib_enum_roce_netdev+0x14b/0x250 [ib_core] ib_cache_setup_one+0x2e5/0x540 [ib_core] ib_register_device+0x82c/0xf10 [ib_core] 0xffffffffc2df5ad9 0xffffffffc2da8b07 0xffffffffc2db174d auxiliary_bus_probe+0xa5/0x120 really_probe+0x1e4/0x850 __driver_probe_device+0x18f/0x3d0 Fixes: 4a62c5e9e2e1 ("RDMA/bnxt_re: Do not free the ctx_tbl entry if delete GID fails") Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Link: https://patch.msgid.link/20250805101000.233310-4-kalesh-anakkur.purayil@broadcom.com Reviewed-by: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/bnxt_re: Fix to remove workload check in SRQ limit pathKashyap Desai
There should not be any checks of current workload to set srq_limit value to SRQ hw context. Remove all such workload checks and make a direct call to set srq_limit via doorbell SRQ_ARM. Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters") Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com> Signed-off-by: Saravanan Vajravel <saravanan.vajravel@broadcom.com> Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Link: https://patch.msgid.link/20250805101000.233310-3-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/bnxt_re: Fix to do SRQ armena by defaultKashyap Desai
Whenever SRQ is created, make sure SRQ arm enable is always set. Driver is always ready to receive SRQ ASYNC event. Additional note - There is no need to do srq arm enable conditionally. See bnxt_qplib_armen_db in bnxt_qplib_create_cq(). Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters") Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com> Signed-off-by: Saravanan Vajravel <saravanan.vajravel@broadcom.com> Link: https://patch.msgid.link/20250805101000.233310-2-kalesh-anakkur.purayil@broadcom.com Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/hns: Fix querying wrong SCC context for DIP algorithmwenglianfa
When using DIP algorithm, all QPs establishing connections with the same destination IP share the same SCC, which is indexed by dip_idx, but dip_idx isn't necessarily equal to qpn. Therefore, dip_idx should be used to query SCC context instead of qpn. Fixes: 124a9fbe43aa ("RDMA/hns: Append SCC context to the raw dump of QPC") Signed-off-by: wenglianfa <wenglianfa@huawei.com> Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com> Link: https://patch.msgid.link/20250726075345.846957-1-huangjunxian6@hisilicon.com Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/mana_ib: Drain send wrs of GSI QPKonstantin Taranov
Drain send WRs of the GSI QP on device removal. In rare servicing scenarios, the hardware may delete the state of the GSI QP, preventing it from generating CQEs for pending send WRs. Since WRs submitted to the GSI QP hold CM resources, the device cannot be removed until those WRs are completed. This patch marks all pending send WRs as failed, allowing the GSI QP to release the CM resources and enabling safe device removal. Signed-off-by: Konstantin Taranov <kotaranov@microsoft.com> Link: https://patch.msgid.link/1753779618-23629-1-git-send-email-kotaranov@linux.microsoft.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/erdma: Use dma_map_page to map scatter MTT bufferBoshi Yu
Each high-level indirect MTT entry is assumed to point to exactly one page of the low-level MTT buffer, but dma_map_sg may merge contiguous physical pages when mapping. To avoid extra overhead from splitting merged regions, use dma_map_page to map the scatter MTT buffer page by page. Reviewed-by: Cheng Xu <chengyou@linux.alibaba.com> Signed-off-by: Boshi Yu <boshiyu@linux.alibaba.com> Link: https://patch.msgid.link/20250725055410.67520-2-boshiyu@linux.alibaba.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/erdma: Fix unset QPN of GSI QPBoshi Yu
The QPN of the GSI QP was not set, which may cause issues. Set the QPN to 1 when creating the GSI QP. Fixes: 999a0a2e9b87 ("RDMA/erdma: Support UD QPs and UD WRs") Reviewed-by: Cheng Xu <chengyou@linux.alibaba.com> Signed-off-by: Boshi Yu <boshiyu@linux.alibaba.com> Link: https://patch.msgid.link/20250725055410.67520-4-boshiyu@linux.alibaba.com Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/erdma: Fix ignored return value of init_kernel_qpBoshi Yu
The init_kernel_qp interface may fail. Check its return value and free related resources properly when it does. Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation") Reviewed-by: Cheng Xu <chengyou@linux.alibaba.com> Signed-off-by: Boshi Yu <boshiyu@linux.alibaba.com> Link: https://patch.msgid.link/20250725055410.67520-3-boshiyu@linux.alibaba.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/rxe: Flush delayed SKBs while releasing RXE resourcesZhu Yanjun
When skb packets are sent out, these skb packets still depends on the rxe resources, for example, QP, sk, when these packets are destroyed. If these rxe resources are released when the skb packets are destroyed, the call traces will appear. To avoid skb packets hang too long time in some network devices, a timestamp is added when these skb packets are created. If these skb packets hang too long time in network devices, these network devices can free these skb packets to release rxe resources. Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153 Tested-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com Fixes: 1a633bdc8fd9 ("RDMA/rxe: Let destroy qp succeed with stuck packet") Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev> Link: https://patch.msgid.link/20250726013104.463570-1-yanjun.zhu@linux.dev Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/ucma: Support write an event into a CMMark Zhang
Enable user-space to inject an event into a CM through it's event channel. Two new events are added and supported: RDMA_CM_EVENT_USER and RDMA_CM_EVENT_INTERNAL. With these 2 events a new event parameter "arg" is supported, which is passed from sender to receiver transparently. With this feature an application is able to write an event into a CM channel with a new user-space rdmacm API. For example thread T1 could write an event with the API: rdma_write_cm_event(cm_id, RDMA_CM_EVENT_USER, status, arg); and thread T2 could receive the event with rdma_get_cm_event(). Signed-off-by: Mark Zhang <markzhang@nvidia.com> Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com> Link: https://patch.msgid.link/fdf49d0b17a45933c5d8c1d90605c9447d9a3c73.1751279794.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/ucma: Support query resolved service recordsMark Zhang
Enable user-space to query resolved service records through a ucma command when a RDMA_CM_EVENT_ADDRINFO_RESOLVED event is received. Signed-off-by: Or Har-Toov <ohartoov@nvidia.com> Signed-off-by: Mark Zhang <markzhang@nvidia.com> Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com> Link: https://patch.msgid.link/1090ee7c00c3f8058c4f9e7557de983504a16715.1751279794.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/cma: Support IB service record resolutionMark Zhang
Add new UCMA command and the corresponding CMA implementation. Userspace can send this command to request service resolution based on service name or ID. On a successful resolution, one or multiple service records are returned, the first one will be used as destination address by default. Two new CM events are added and returned to caller accordingly: - RDMA_CM_EVENT_ADDRINFO_RESOLVED: Resolve succeeded; - RDMA_CM_EVENT_ADDRINFO_ERROR: Resolve failed. Internally two new CM states are added: - RDMA_CM_ADDRINFO_QUERY: CM is in the process of IB service resolution; - RDMA_CM_ADDRINFO_RESOLVED: CM has finished the resolve process. With these new states, beside existing state transfer processes, 2 new processes are supported: 1. The default address is used: RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDRINFO_QUERY -> RDMA_CM_ADDRINFO_RESOLVED -> RDMA_CM_ROUTE_QUERY 2. To use a different address: RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDRINFO_QUERY-> RDMA_CM_ADDRINFO_RESOLVED -> RDMA_CM_ADDR_QUERY -> RDMA_CM_ADDR_RESOLVED -> RDMA_CM_ROUTE_QUERY In the 2nd case, resolve_addrinfo returns multiple records, a user could call rdma_resolve_addr() with the one that is not the first. Signed-off-by: Or Har-Toov <ohartoov@nvidia.com> Signed-off-by: Mark Zhang <markzhang@nvidia.com> Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com> Link: https://patch.msgid.link/b6e82ad75522a13b5efe4ff86da0e465aab04cc2.1751279794.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/sa_query: Support IB service records resolutionMark Zhang
Add an SA query API ib_sa_service_rec_get() to support building and sending SA query MADs that ask for service records with a specific name or ID, and receiving and parsing responses from the SM. Signed-off-by: Or Har-Toov <ohartoov@nvidia.com> Signed-off-by: Mark Zhang <markzhang@nvidia.com> Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com> Link: https://patch.msgid.link/9af6c82f3a3a9d975115a33235fb4ffc7c8edb21.1751279793.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13RDMA/sa_query: Add RMPP support for SA queriesMark Zhang
Register GSI mad agent with RMPP support and add rmpp_callback for SA queries. This is needed for querying more than one service record in one query. Signed-off-by: Or Har-Toov <ohartoov@nvidia.com> Signed-off-by: Mark Zhang <markzhang@nvidia.com> Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com> Link: https://patch.msgid.link/81dbcb48682e1838dc40f381cdcc0dc63f25f0f1.1751279793.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-08-13regulator: rt5133: Add RT5133 PMIC regulator SupportJeff Chang
RT5133 is a highly-integrated chip. It includes 8 LDOs and 3 GPOs that can be used to drive output high/low purpose. The dependency of the GPO block is internally LDO1 Voltage. Signed-off-by: Jeff Chang <jeff_chang@richtek.com> Link: https://patch.msgid.link/20250813020910.2977555-2-jeff_chang@richtek.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-13platform/chrome: wilco_ec: Remove redundant semicolonsLiao Yuanhong
Remove unnecessary semicolons. Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com> Link: https://lore.kernel.org/r/20250813094858.557742-1-liaoyuanhong@vivo.com Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
2025-08-13platform/chrome: cros_ec: Avoid -Wflex-array-member-not-at-end warningGustavo A. R. Silva
-Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the new TRAILING_OVERLAP() helper to fix the following warning: drivers/platform/chrome/cros_ec.c:106:40: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] This helper creates a union between a flexible-array member (FAM) and a set of members that would otherwise follow it. This overlays the trailing members onto the FAM while preserving the original memory layout. Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://lore.kernel.org/r/aJnvuv334M7TljoB@kspp Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
2025-08-13Revert "drm/amdgpu: Use dma_buf from GEM object instance"Thomas Zimmermann
This reverts commit 515986100d176663d0a03219a3056e4252f729e6. The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: Acquire internal references on GEM handles") only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using .import_attach->dmabuf. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Simona Vetter <simona.vetter@ffwll.ch> Acked-by: Alex Deucher <alexander.deucher@amd.com> Link: https://lore.kernel.org/r/20250715082635.34974-1-tzimmermann@suse.de
2025-08-13drm/panel: panel-summit: Include <linux/property.h> and ↵Thomas Zimmermann
<linux/mod_devicetable.h> Include <linux/property.h> to declare device_property_read_u32() and <linux/mod_devicetable.h> to declare struct of_device_id. Avoids the dependency on the backlight header to include it. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250812081118.221103-1-tzimmermann@suse.de
2025-08-13HID: asus: fix UAF via HID_CLAIMED_INPUT validationQasim Ijaz
After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device. This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees. 0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection Below is the KASAN splat after triggering the UAF: [ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] <TASK> [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfree+0xcf/0x350 [ 21.673700] input_dev_release+0xab/0xd0 [ 21.673700] device_release+0x9f/0x220 [ 21.673700] kobject_put+0x12b/0x220 [ 21.673700] put_device+0x12/0x20 [ 21.673700] input_free_device+0x4c/0xb0 [ 21.673700] hidinput_connect+0x1862/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] Fixes: 9ce12d8be12c ("HID: asus: Add i2c touchpad support") Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Link: https://patch.msgid.link/20250810181041.44874-1-qasdev00@gmail.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-08-13hid: fix I2C read buffer overflow in raw_event() for mcp2221Arnaud Lecomte
As reported by syzbot, mcp2221_raw_event lacked validation of incoming I2C read data sizes, risking buffer overflows in mcp->rxbuf during multi-part transfers. As highlighted in the DS20005565B spec, p44, we have: "The number of read-back data bytes to follow in this packet: from 0 to a maximum of 60 bytes of read-back bytes." This patch enforces we don't exceed this limit. Reported-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346 Tested-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com> Link: https://patch.msgid.link/20250726220931.7126-1-contact@arnaud-lcm.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-08-13drm/i915/display: Optimize panel power-on wait timeDibin Moolakadan Subrahmanian
The current wait_panel_status() uses intel_de_wait(), which internally on Xe platforms calls xe_mmio_wait32(). xe_mmio_wait32() increases poll interval exponentially. This exponential poll interval increase causes unnessory delays during resume or power-on when the panel becomes ready earlier, but polling is delayed due to backoff. Replace intel_de_wait() with read_poll_timeout() + intel_de_read() to actively poll the register at a fixed 10ms interval up to a 5 second timeout. This allows poll to exit early when panel is ready. Changes in v2: Replaced two-phase intel_de_wait() with read_poll_timeout() + intel_de_read() Changes in v3: - Add poll_interval_ms argument 'wait_panel_status' function. - Modify 'wait_panel_status' callers with proper poll interval Changes in v4: - Change 'wait_panel_off' poll interval to 10ms Changes in v5: - Dropped poll_interval_ms parameter,use fixed polling interval of 10ms (Jani Nikula) Changes in v6: - Removed goto in error path Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com> Link: https://lore.kernel.org/r/20250807082402.79018-1-dibin.moolakadan.subrahmanian@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2025-08-13drm/tidss: Remove early fbTomi Valkeinen
Add a call to drm_aperture_remove_framebuffers() to drop the possible early fb (simplefb). Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://lore.kernel.org/r/20250416-tidss-splash-v1-2-4ff396eb5008@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13thunderbolt: Use Linux Foundation IDs for XDomain discoveryMika Westerberg
There are other vendors now that have their own USB4 host router hardware so using the Intel donated IDs may confuse users. For this reason switch to use USB IDs provided by the Linux Foundation for XDomain discovery. Link: https://lore.kernel.org/linux-usb/20250722175026.1994846-1-Raju.Rangoju@amd.com/ Cc: Raju Rangoju <Raju.Rangoju@amd.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2025-08-13drm/tidss: remove redundant assignment to variable retColin Ian King
The assignment of zero to variable is redundant as the following continue statement loops back to the start of the loop where ret is assigned a new value from the return to the call to get_parent_dss_vp. Remove assignment. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://lore.kernel.org/r/20250702084844.966199-1-colin.i.king@gmail.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/tidss: Set crtc modesetting parameters with adjusted modeJayesh Choudhary
TIDSS uses crtc_* fields to propagate its registers and set the clock rates. So set the CRTC modesetting timing parameters with the adjusted mode when needed, to set correct values. Cc: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com> Link: https://lore.kernel.org/r/20250624080402.302526-1-j-choudhary@ti.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probeZhen Ni
The of_platform_populate() call at the end of the function has a possible failure path, causing a resource leak. Replace of_iomap() with devm_platform_ioremap_resource() to ensure automatic cleanup of srom->reg_base. This issue was detected by smatch static analysis: drivers/memory/samsung/exynos-srom.c:155 exynos_srom_probe()warn: 'srom->reg_base' from of_iomap() not released on lines: 155. Fixes: 8ac2266d8831 ("memory: samsung: exynos-srom: Add support for bank configuration") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni <zhen.ni@easystack.cn> Link: https://lore.kernel.org/r/20250806025538.306593-1-zhen.ni@easystack.cn Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
2025-08-13gpio: aggregator: Fix off by one in gpiochip_fwd_desc_add()Dan Carpenter
The "> chip->ngpio" comparison here needs to be ">= chip->ngpio", otherwise it leads to an out of bounds access. The fwd->valid_mask bitmap only has chip->ngpio bits and the fwd->descs[] array has that same number of elements. These values are set in devm_gpiochip_fwd_alloc(). Fixes: c44ce91b8ada ("gpio: aggregator: refactor the code to add GPIO desc in the forwarder") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://lore.kernel.org/r/aJwk0yBSCccGCjX3@stanley.mountain Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-08-13drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURSTTomi Valkeinen
While the cdns-dsi does not support DSI burst mode, the burst mode is essentially DSI event mode with more versatile clocking and timings. Thus cdns-dsi doesn't need to fail if the DSI peripheral driver requests MIPI_DSI_MODE_VIDEO_BURST. In my particular use case, this allows the use of ti-sn65dsi83 driver. Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-15-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-19 14:26:24 +0000