summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-11-29scsi: imm: Fix use-after-free bug caused by unfinished delayed workDuoming Zhou
The delayed work item 'imm_tq' is initialized in imm_attach() and scheduled via imm_queuecommand() for processing SCSI commands. When the IMM parallel port SCSI host adapter is detached through imm_detach(), the imm_struct device instance is deallocated. However, the delayed work might still be pending or executing when imm_detach() is called, leading to use-after-free bugs when the work function imm_interrupt() accesses the already freed imm_struct memory. The race condition can occur as follows: CPU 0(detach thread) | CPU 1 | imm_queuecommand() | imm_queuecommand_lck() imm_detach() | schedule_delayed_work() kfree(dev) //FREE | imm_interrupt() | dev = container_of(...) //USE dev-> //USE Add disable_delayed_work_sync() in imm_detach() to guarantee proper cancellation of the delayed work item before imm_struct is deallocated. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Link: https://patch.msgid.link/20251028100149.40721-1-duoming@zju.edu.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29scsi: target: sbp: Remove KMSG_COMPONENT macroHeiko Carstens
The KMSG_COMPONENT macro is a leftover of the s390 specific "kernel message catalog" from 2008 [1] which never made it upstream. The macro was added to s390 code to allow for an out-of-tree patch which used this to generate unique message ids. Also this out-of-tree doesn't exist anymore. The pattern of how the KMSG_COMPONENT is used was partially also used for non s390 specific code, for whatever reasons. Remove the macro in order to get rid of a pointless indirection. [1] https://lwn.net/Articles/292650/ Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Link: https://patch.msgid.link/20251126144027.2213895-1-hca@linux.ibm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29scsi: core: Correct documentation for scsi_device_quiesce()Miao Li
If scsi_device_quiesce() returns zero, the function executed successfully. Signed-off-by: Miao Li <limiao@kylinos.cn> Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> Link: https://patch.msgid.link/20251124075444.32699-1-limiao870622@163.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29remoteproc: qcom_wcnss: Fix NULL vs IS_ERR() bug in wcnss_alloc_memory_region()Dan Carpenter
The devm_ioremap_resource_wc() function never returns NULL, it returns error pointers. Update the checking to match. Fixes: c70b9d5fdcd7 ("remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region"") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/09a43da41ee277a80a3265348831e747f7b62620.1764427595.git.dan.carpenter@linaro.org Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-11-29remoteproc: qcom: q6v5: Fix NULL vs IS_ERR() bug in q6v5_alloc_memory_region()Dan Carpenter
The devm_ioremap_resource_wc() function never returns NULL, it returns error pointers. Update the checking to match. Fixes: c70b9d5fdcd7 ("remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region"") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/674b32a78563282adeaf3cdf941314a0b8181026.1764427595.git.dan.carpenter@linaro.org Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-11-29remoteproc: qcom: pas: Fix a couple NULL vs IS_ERR() bugsDan Carpenter
The devm_ioremap_resource_wc() function never returns NULL, it returns error pointers. Update the checking to match. Fixes: c70b9d5fdcd7 ("remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region"") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/0599691acc394d9390da8fa0b5de3399b132b187.1764427595.git.dan.carpenter@linaro.org Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-11-29remoteproc: qcom_q6v5_adsp: Fix a NULL vs IS_ERR() check in ↵Dan Carpenter
adsp_alloc_memory_region() The devm_ioremap_resource_wc() function never returns NULL, it returns error pointers. Update the check to match. Fixes: c70b9d5fdcd7 ("remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region"") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/6d6b1b0fb6a61b5155a640507217fd7e658858cf.1764427595.git.dan.carpenter@linaro.org Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-11-29scsi: mpi3mr: Prevent duplicate SAS/SATA device entries in channel 1Suganath Prabu S
Avoid scanning SAS/SATA devices in channel 1 when SAS transport is enabled, as the SAS/SATA devices are exposed through channel 0. Signed-off-by: Suganath Prabu S <suganath-prabu.subramani@broadcom.com> Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com> Link: https://lore.kernel.org/stable/20251120071955.463475-1-suganath-prabu.subramani%40broadcom.com Link: https://patch.msgid.link/20251120071955.463475-1-suganath-prabu.subramani@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29scsi: target: Reset t_task_cdb pointer in error caseAndrey Vatoropin
If allocation of cmd->t_task_cdb fails, it remains NULL but is later dereferenced in the 'err' path. In case of error, reset NULL t_task_cdb value to point at the default fixed-size buffer. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 9e95fb805dc0 ("scsi: target: Fix NULL pointer dereference") Cc: stable@vger.kernel.org Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru> Reviewed-by: Mike Christie <michael.christie@oracle.com> Link: https://patch.msgid.link/20251118084014.324940-1-a.vatoropin@crpt.ru Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29scsi: ufs: core: Fix EH failure after W-LUN resume errorBrian Kao
When a W-LUN resume fails, its parent devices in the SCSI hierarchy, including the scsi_target, may be runtime suspended. Subsequently, the error handler in ufshcd_recover_pm_error() fails to set the W-LUN device back to active because the parent target is not active. This results in the following errors: google-ufshcd 3c2d0000.ufs: ufshcd_err_handler started; HBA state eh_fatal; ... ufs_device_wlun 0:0:0:49488: START_STOP failed for power mode: 1, result 40000 ufs_device_wlun 0:0:0:49488: ufshcd_wl_runtime_resume failed: -5 ... ufs_device_wlun 0:0:0:49488: runtime PM trying to activate child device 0:0:0:49488 but parent (target0:0:0) is not active Address this by: 1. Ensuring the W-LUN's parent scsi_target is runtime resumed before attempting to set the W-LUN to active within ufshcd_recover_pm_error(). 2. Explicitly checking for power.runtime_error on the HBA and W-LUN devices before calling pm_runtime_set_active() to clear the error state. 3. Adding pm_runtime_get_sync(hba->dev) in ufshcd_err_handling_prepare() to ensure the HBA itself is active during error recovery, even if a child device resume failed. These changes ensure the device power states are managed correctly during error recovery. Signed-off-by: Brian Kao <powenkao@google.com> Tested-by: Brian Kao <powenkao@google.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20251112063214.1195761-1-powenkao@google.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29zram: fix a spelling mistakeChu Guangqing
The spelling of the word "relases" is incorrect; it should be "releases". Link: https://lkml.kernel.org/r/20251125020522.1913-1-chuguangqing@inspur.com Signed-off-by: Chu Guangqing <chuguangqing@inspur.com> Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Jens Axboe <axboe@kernel.dk> Cc: Minchan Kim <minchan@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-11-29Merge tag 'nand/for-6.19' into mtd/nextMiquel Raynal
Raw NAND changes: * The major change in this MR will be the support for the Allwinner H616 NAND controller, which lead to numerous changes and cleanups in the driver. * Another notable change on this driver is the use of field_get()/field_prep(), but since the global support for this helpers is going to be merged in the same release as we start using these helpers, it implies undefining them in the first place to avoid warnings. Depending on the merging order (Yuri's bitmap branch or mtd/next), a temporary warning may arise. * Marvell drivers layout handling changes have also landed, they fix previous definitions and abuses that have been made previously, which implied to relax the ECC parameters validation in the core a bit. * The Cadence NAND controller driver gets NV-DDR interface support. SPI NAND changes: * Support for FudanMicro FM25S01BI3 and ESMT F50L1G41LC is added. Aside from these main changes, there is the usual load of fixes and API updates.
2025-11-29Merge tag 'spi-nor/for-6.19' of ↵Miquel Raynal
https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux into mtd/next SPI NOR changes for 6.19 Notable changes: - Fix SMPT parsing for S25FS-S flash family. They report variable dummy cycles for reads. This results in the default of 0 being used. This works for other Infineon chips, but not for the S25FS-S family. They need 8 dummy cycles. Add fixup hooks to specify that. Also add fixup hooks to fix incorrect map ID data in SFDP. - Add support for a bunch of Winbond flashes. Their block protection information is not discoverable, so they need to have an entry in the flash tables to describe that. - Some cleanups for Micron flash support. - Add support for Micron mt35xu01gbba. - Some SPI controllers like the Intel one on the PCI bus do not support the read CR opcode (0x35). Do not use the opcode if the controller does not support it. # -----BEGIN PGP SIGNATURE----- # # iHUEABYKAB0WIQQTlUWNzXGEo3bFmyIR4drqP028CQUCaSjP+QAKCRAR4drqP028 # CfGsAQC5Vj+FaeQHyY+yywqM5wxE+xj6mMCDNixd2FVYlf5b7wEA2/9bpiHjy3qi # 4MZmFJNcE+XsxReWDTBTZ6VbrjDlqg0= # =M+s4 # -----END PGP SIGNATURE----- # gpg: Signature made jeu. 27 nov. 2025 23:26:01 CET # gpg: using EDDSA key 1395458DCD7184A376C59B2211E1DAEA3F4DBC09 # gpg: Good signature from "Pratyush Yadav <p.yadav@ti.com>" [expired] # gpg: aka "Pratyush Yadav <me@yadavpratyush.com>" [expired] # gpg: p.yadav@ti.com: Verified 5 signatures in the past 3 years. Encrypted 0 messages. # gpg: me@yadavpratyush.com: Verified 5 signatures in the past 3 years. Encrypted # 0 messages. # gpg: Note: This key has expired! # Primary key fingerprint: 805C 3923 2FBE 108C 49E1 663C F650 3556 C11B 1CCD # Subkey fingerprint: 1395 458D CD71 84A3 76C5 9B22 11E1 DAEA 3F4D BC09
2025-11-29mtd: sm_ftl: Fix typo in comment in sm_read_lbaThorsten Blum
s/is/if/ Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2025-11-29mtd: sm_ftl: Replace deprecated strncpy with sysfs_emit in sm_attr_showThorsten Blum
strncpy() is deprecated [1] for NUL-terminated destination buffers because it does not guarantee NUL termination. It also unnecessarily NUL-pads the destination buffer if the source is shorter. Replace it with sysfs_emit() using the "%.*s" format specifier and supply the length 'sm_attr->len' to improve sm_attr_show(). Return the number of characters actually written to 'buf' instead of 'sm_attr->len'. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2025-11-29mtd: lpddr_cmds: fix signed shifts in lpddr_cmdsIvan Stepchenko
There are several places where a value of type 'int' is shifted by lpddr->chipshift. lpddr->chipshift is derived from QINFO geometry and might reach 31 when QINFO reports a 2 GiB size - the maximum supported by LPDDR(1) compliant chips. This may cause unexpected sign-extensions when casting the integer value to the type of 'unsigned long'. Use '1UL << lpddr->chipshift' and cast 'j' to unsigned long before shifting so the computation is performed at the destination width. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: c68264711ca6 ("[MTD] LPDDR Command set driver") Signed-off-by: Ivan Stepchenko <sid@itb.spb.ru> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2025-11-29mtd: docg3: fix kernel-doc warningsRandy Dunlap
Fix kernel-doc warnings in docg3.h to avoid build warnings: Warning: ../drivers/mtd/devices/docg3.h:276 bad line: Warning: drivers/mtd/devices/docg3.h:299 struct member 'max_block' not described in 'docg3' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2025-11-29mtd: spinand: add support for FudanMicro FM25S01BI3Mikhail Zhilkin
Add support for FudanMicro FM25S01BI3 SPI NAND. Link: https://www.fmsh.com/nvm/FM25S01BI3_ds_eng.pdf Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2025-11-29i2c: i2c-elektor: Allow building on SMP kernelsMagnus Lindholm
In the past, the i2c-elektor driver was broken on SMP. Since then, there appear to have been some fixes and cleanup work (as pointed out by Wolfram Sang) to get rid of cli/sti usage and rely on spinlocks instead. Therefore, let's allow building the driver on SMP kernels again. I've tested this driver on an SMP kernel on an Alpha UP2000+ for a few days without any problems. Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
2025-11-28net: bcmgenet: extract GRXRINGS from .get_rxnfcBreno Leitao
Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns bcmgenet with the new ethtool API for querying RX ring parameters. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20251127-grxrings_broadcom-v1-2-b0b182864950@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-28net: bnxt: extract GRXRINGS from .get_rxnfcBreno Leitao
Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns bnxt with the new ethtool API for querying RX ring parameters. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20251127-grxrings_broadcom-v1-1-b0b182864950@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-28net: phy: aquantia: check for NVMEM deferralRobert Marko
Currently, if NVMEM provider is probed later than Aquantia, loading the firmware will fail with -EINVAL. To fix this, simply check for -EPROBE_DEFER when NVMEM is attempted and return it. Fixes: e93984ebc1c8 ("net: phy: aquantia: add firmware load support") Signed-off-by: Robert Marko <robimarko@gmail.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20251127114514.460924-1-robimarko@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-28Merge tag 'wireless-next-2025-11-27' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Apart from the usual small things just driver updates: - mt76: - WED support for >32-bit DMA - airoha NPU support - regdomain improvements - continued WiFi7/MLO work - rtw89 - support USB devices RTL8852AU and RTL8852CU - initial work for RTL8922DE - improved injection support - rtl8xxxu: 40 MHz connection fixes/support - brcmfmac: Acer A1 840 tablet quirk * tag 'wireless-next-2025-11-27' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (152 commits) wifi: mac80211: allow sharing identical chanctx for S1G interfaces wifi: nl80211: vendor-cmd: intel: fix a blank kernel-doc line warning wifi: cfg80211: include s1g_primary_2mhz when comparing chandefs wifi: cfg80211: include s1g_primary_2mhz when sending chandef wifi: ieee80211: correct FILS status codes mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load wifi: mt76: Strip whitespace from build ddate wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work() wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove wifi: mt76: mt7996: skip deflink accounting for offchannel links wifi: mt76: Move mt76_abort_scan out of mt76_reset_device() wifi: mt76: mt7996: move mt7996_update_beacons under mt76 mutex wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event() wifi: mt76: mt7925: ensure the 6GHz A-MPDU density cap from the hardware. wifi: mt76: mt7996: fix EMI rings for RRO wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart() wifi: mt76: mt7996: fix MLO set key and group key issues wifi: mt76: mt7996: fix MLD group index assignment wifi: mt76: mt7996: use correct link_id when filling TXD and TXP ... ==================== Link: https://patch.msgid.link/20251127103806.17776-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-29i3c: master: svc: Add basic HDR mode supportFrank Li
Add basic HDR mode support for the svs I3C master driver. Only support for private transfers and does not support sending CCC commands in HDR mode. Key differences: - HDR uses commands (0x00-0x7F for write, 0x80-0xFF for read) to distinguish transfer direction. - HDR read/write commands must be written to FIFO before issuing the I3C address command. The hardware automatically sends the standard CCC command to enter HDR mode. - HDR exit pattern must be sent instead of send a stop after transfer completion. - Read/write data size must be an even number. Co-developed-by: Carlos Song <carlos.song@nxp.com> Signed-off-by: Carlos Song <carlos.song@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251106-i3c_ddr-v11-4-33a6a66ed095@nxp.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: master: svc: Replace bool rnw with union for HDR supportFrank Li
Replace the bool rnw field with a union in preparation for adding HDR support. HDR uses a cmd field instead of the rnw bit to indicate read or write direction. Add helper function svc_cmd_is_read() to check transfer direction. Add a local variable 'rnw' in svc_i3c_master_priv_xfers() to avoid repeatedly accessing xfers[i].rnw. No functional change. Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251106-i3c_ddr-v11-3-33a6a66ed095@nxp.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: Add HDR API supportFrank Li
Rename struct i3c_priv_xfer to struct i3c_xfer, since private xfer in the I3C spec refers only to SDR transfers. Ref: i3c spec ver1.2, section 3, Technical Overview. i3c_xfer will be used for both SDR and HDR. Rename enum i3c_hdr_mode to i3c_xfer_mode. Previous definition need match CCC GET_CAP1 bit position. Use 31 as SDR transfer mode. Add i3c_device_do_xfers() with an xfer mode argument, while keeping i3c_device_do_priv_xfers() as a wrapper that calls i3c_device_do_xfers() with I3C_SDR for backward compatibility. Introduce a 'cmd' field in struct i3c_xfer as an anonymous union with 'rnw', since HDR mode uses read/write commands instead of the SDR address bit. Add .i3c_xfers() callback for master controllers. If not implemented, fall back to SDR with .priv_xfers(). The .priv_xfers() API can be removed once all controllers switch to .i3c_xfers(). Add 'mode_mask' bitmask to advertise controller capability. Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251106-i3c_ddr-v11-1-33a6a66ed095@nxp.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: master: add WQ_PERCPU to alloc_workqueue usersMarco Crivellari
Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Link: https://patch.msgid.link/20251107132949.184944-1-marco.crivellari@suse.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: master: Remove i3c_device_free_ibi from i3c_device_removeJorge Marques
i3c_device_disable_ibi should be called before i3c_device_free_ibi, however, a driver using devm actions cannot yield the call before the bus_type.remove(), requiring to use a .remove method that is usually discouraged for drivers that uses resources already manage. Since the only consumer mctp-i3c.c of this method calls both i3c_device_disable_ibi then i3c_device_free_ibi, remove the call from the i3c_device_remove (bus_type.remove()). Signed-off-by: Jorge Marques <jorge.marques@analog.com> Link: https://patch.msgid.link/20251112-ibi-unsafe-v1-1-d8454db22613@analog.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: mipi-i3c-hci-pci: Set d3cold_delay to 0 for Intel controllersAdrian Hunter
Set d3cold_delay to 0 for Intel controllers because a delay is not needed. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251128064038.55158-13-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: mipi-i3c-hci-pci: Add LTR support for Intel controllersAdrian Hunter
Add support for Latency Tolerance Reporting (LTR) for Intel controllers. Implement PM ->set_latency_tolerance() callback to set LTR register values. Also expose LTR register values via debugfs. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251128064038.55158-12-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: mipi-i3c-hci-pci: Add exit callbackAdrian Hunter
Prepare to add device-specific features that require cleanup upon driver removal. Add ->exit() callback as a counterpart to ->init(). Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251128064038.55158-11-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: mipi-i3c-hci-pci: Change callback parameterAdrian Hunter
Prepare to add more callbacks in mipi_i3c_hci_pci_info. Change ->init() callback parameter from PCI device pointer to mipi_i3c_hci_pci_info device pointer. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251128064038.55158-10-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: mipi-i3c-hci-pci: Allocate a structure for mipi_i3c_hci_pci device ↵Adrian Hunter
information Allocate a structure for mipi_i3c_hci_pci device information, in preparation for additional changes that need to store mipi_i3c_hci_pci device-specific information. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251128064038.55158-9-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: mipi-i3c-hci-pci: Factor out intel_reset()Adrian Hunter
For neatness, factor out intel_reset(). Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251128064038.55158-8-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: mipi-i3c-hci-pci: Factor out private registers ioremappingAdrian Hunter
For neatness, factor out private registers ioremapping. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251128064038.55158-7-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: mipi-i3c-hci-pci: Constify driver dataAdrian Hunter
Add const qualifier to driver data because it is constant. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251128064038.55158-6-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: mipi-i3c-hci-pci: Use readl_poll_timeout()Adrian Hunter
Use readl_poll_timeout() instead of open-coding the polling loop. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251128064038.55158-5-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: mipi-i3c-hci-pci: Rename some Intel-related identifiersAdrian Hunter
Rename some Intel-related identifiers to ensure Intel-related identifiers begin "intel_" or INTEL_, and for brevity removing purposeless "PRIV" in preparation to add more register definitions. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251128064038.55158-4-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: mipi-i3c-hci-pci: Move all Intel-related definitions togetherAdrian Hunter
Move all Intel-related definitions together, to tidy the code slightly. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251128064038.55158-3-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-29i3c: mipi-i3c-hci-pci: Set 64-bit DMA mask for Intel controllersAdrian Hunter
All Intel controllers support 64-bit DMA. Set the DMA mask accordingly. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251128064038.55158-2-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-11-28Merge tag 'spi-fix-v6.18-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A disappointingly large set of device specific fixes that have built up since I've been a bit tardy with sending a pull requests as people kept sending me new new fixes. The bcm63xx and lpspi issues could lead to corruption so the fixes are fairly important for the affected parts, the other issues should all be relatively minor" * tag 'spi-fix-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: nxp-fspi: Propagate fwnode in ACPI case as well spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors spi: spi-fsl-lpspi: fix watermark truncation caused by type cast spi: cadence-quadspi: Fix cqspi_probe() error handling for runtime pm spi: bcm63xx: fix premature CS deassertion on RX-only transactions spi: spi-cadence-quadspi: Remove duplicate pm_runtime_put_autosuspend() call spi: spi-cadence-quadspi: Enable pm runtime earlier to avoid imbalance
2025-11-28vfio/xe: Add device specific vfio_pci driver variant for Intel graphicsMichał Winiarski
In addition to generic VFIO PCI functionality, the driver implements VFIO migration uAPI, allowing userspace to enable migration for Intel Graphics SR-IOV Virtual Functions. The driver binds to VF device and uses API exposed by Xe driver to transfer the VF migration data under the control of PF device. Acked-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Reviewed-by: Alex Williamson <alex@shazbot.org> Link: https://patch.msgid.link/20251127093934.1462188-5-michal.winiarski@intel.com Signed-off-by: Michał Winiarski <michal.winiarski@intel.com>
2025-11-28drm/xe/pf: Export helpers for VFIOMichał Winiarski
Device specific VFIO driver variant for Xe will implement VF migration. Export everything that's needed for migration ops. Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Link: https://patch.msgid.link/20251127093934.1462188-4-michal.winiarski@intel.com Signed-off-by: Michał Winiarski <michal.winiarski@intel.com>
2025-11-28drm/xe/pci: Introduce a helper to allow VF access to PF xe_deviceMichał Winiarski
In certain scenarios (such as VF migration), VF driver needs to interact with PF driver. Add a helper to allow VF driver access to PF xe_device. Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Link: https://patch.msgid.link/20251127093934.1462188-3-michal.winiarski@intel.com Signed-off-by: Michał Winiarski <michal.winiarski@intel.com>
2025-11-28drm/xe/pf: Enable SR-IOV VF migrationMichał Winiarski
All of the necessary building blocks are now in place to support SR-IOV VF migration. Flip the enable/disable logic to match VF code and disable the feature only for platforms that don't meet the necessary prerequisites. To allow more testing and experiments, on DEBUG builds any missing prerequisites will be ignored. Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Link: https://patch.msgid.link/20251127093934.1462188-2-michal.winiarski@intel.com Signed-off-by: Michał Winiarski <michal.winiarski@intel.com>
2025-11-28Merge tag 'regulator-fix-v6.18-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of fixes for incorrect device descriptions in the rtq2208 driver" * tag 'regulator-fix-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: rtq2208: Correct LDO2 logic judgment bits regulator: rtq2208: Correct buck group2 phase mapping logic
2025-11-28ubi: fastmap: fix ubi->fm memory leakLiyuan Pang
The problem is that scan_fast() allocate memory for ubi->fm and ubi->fm->e[x], but if the following attach process fails in ubi_wl_init or ubi_read_volume_table, the whole attach process will fail without executing ubi_wl_close to free the memory under ubi->fm. Fix this by add a new ubi_free_fastmap function in fastmap.c to free the memory allocated for fm. If SLUB_DEBUG and KUNIT are enabled, the following warning messages will show: ubi0: detaching mtd0 ubi0: mtd0 is detached ubi0: default fastmap pool size: 200 ubi0: default fastmap WL pool size: 100 ubi0: attaching mtd0 ubi0: attached by fastmap ubi0: fastmap pool size: 200 ubi0: fastmap WL pool size: 100 ubi0 error: ubi_wl_init [ubi]: no enough physical eraseblocks (4, need 203) ubi0 error: ubi_attach_mtd_dev [ubi]: failed to attach mtd0, error -28 UBI error: cannot attach mtd0 ================================================================= BUG ubi_wl_entry_slab (Tainted: G B O L ): Objects remaining in ubi_wl_entry_slab on __kmem_cache_shutdown() ----------------------------------------------------------------------------- Slab 0xffff2fd23a40cd00 objects=22 used=1 fp=0xffff2fd1d0334fd8 flags=0x883fffc010200(slab|head|section=34|node=0|zone=1|lastcpupid=0x7fff) CPU: 0 PID: 5884 Comm: insmod Tainted: G B O L 5.10.0 #1 Hardware name: LS1043A RDB Board (DT) Call trace: dump_backtrace+0x0/0x198 show_stack+0x18/0x28 dump_stack+0xe8/0x15c slab_err+0x94/0xc0 __kmem_cache_shutdown+0x1fc/0x39c kmem_cache_destroy+0x48/0x138 ubi_init+0x1d4/0xf34 [ubi] do_one_initcall+0xb4/0x24c do_init_module+0x4c/0x1dc load_module+0x212c/0x2260 __se_sys_finit_module+0xb4/0xd8 __arm64_sys_finit_module+0x18/0x28 el0_svc_common.constprop.0+0x78/0x1a0 do_el0_svc+0x78/0x90 el0_svc+0x20/0x38 el0_sync_handler+0xf0/0x140 normal+0x3d8/0x400 Object 0xffff2fd1d0334e68 @offset=3688 Allocated in ubi_scan_fastmap+0xf04/0xf40 [ubi] age=80 cpu=0 pid=5884 __slab_alloc.isra.21+0x6c/0xb4 kmem_cache_alloc+0x1e4/0x80c ubi_scan_fastmap+0xf04/0xf40 [ubi] ubi_attach+0x1f0/0x3a8 [ubi] ubi_attach_mtd_dev+0x810/0xbc8 [ubi] ubi_init+0x238/0xf34 [ubi] do_one_initcall+0xb4/0x24c do_init_module+0x4c/0x1dc load_module+0x212c/0x2260 __se_sys_finit_module+0xb4/0xd8 __arm64_sys_finit_module+0x18/0x28 el0_svc_common.constprop.0+0x78/0x1a0 do_el0_svc+0x78/0x90 el0_svc+0x20/0x38 el0_sync_handler+0xf0/0x140 normal+0x3d8/0x400 Link: https://bugzilla.kernel.org/show_bug.cgi?id=220744 Signed-off-by: Liyuan Pang <pangliyuan1@huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2025-11-28mtd: ubi: skip programming unused bits in ubi headersCheng Ming Lin
This patch prevents unnecessary programming of bits in ec_hdr and vid_hdr that are not used or read during normal UBI operation. These unused bits are typcially already set to 1 in erased flash and do not need to be explicitly programmed to 0 if they are not used. Programming such unused areas offers no functional benefit and may result in unnecessary flash wear, reducing the overall lifetime of the device. By skipping these writes, we preserve the flash state as much as possible and minimize wear caused by redundant operations. This change ensures that only necessary fields are written when preparing UBI headers, improving flash efficiency without affecting functionality. Additionally, the Kioxia TC58NVG1S3HTA00 datasheet (page 63) also notes that continuous program/erase cycling with a high percentage of '0' bits in the data pattern can accelerate block endurance degradation. This further supports avoiding large 0x00 patterns. Link: https://europe.kioxia.com/content/dam/kioxia/newidr/productinfo/datasheet/201910/DST_TC58NVG1S3HTA00-TDE_EN_31442.pdf Signed-off-by: Cheng Ming Lin <chengminglin@mxic.com.tw> Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com> Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2025-11-28regulator: fp9931: Fix spelling mistake "failid" -> "failed"Colin Ian King
There is a spelling mistake in a dev_err_probe message. Fix it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://patch.msgid.link/20251128173330.318309-1-colin.i.king@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-11-28spi: microchip-core: Refactor FIFO read and write handlersAndy Shevchenko
Make both handlers to be shorter and easier to understand. While at it, unify their style. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Prajna Rajendra Kumar <prajna.rajendrakumar@microchip.com> Link: https://patch.msgid.link/20251127190031.2998705-3-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>