summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-07-17netconsole: move skb_pool_flush() from netpollBreno Leitao
skb_pool_flush() has no callers left in net/core/netpoll.c after netconsole took over the pool lifecycle. Inline its body into netconsole_skb_pool_flush() (the only caller) and drop the function and its export from netpoll. The prototype goes from <linux/netpoll.h>. Pure code motion: cancel_work_sync() + skb_queue_purge_reason() semantics are unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-6-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move local_port / remote_port from struct netpoll to ↵Breno Leitao
netconsole_target The source and destination UDP ports live in struct netpoll but are netconsole configuration. No other netpoll user (bonding, team, vlan, bridge, macvlan, dsa) touches np->local_port or np->remote_port; they only use the netpoll TX/forwarding path. Only netconsole's UDP framing and its configfs/cmdline interface read these fields. Move both into struct netconsole_target and convert the three helpers that read them - push_udp(), netconsole_print_banner() and netconsole_parser_cmdline() - to take the netconsole_target. The configfs show/store handlers already have the target in hand. No functional change; the local_port / remote_port sysfs attributes are unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-8-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move refill_skbs() and skb-pool sizing macros from netpollBreno Leitao
refill_skbs() is now only called from netconsole (directly via netconsole_skb_pool_init() and indirectly via the just-moved refill_skbs_work_handler()), and the MAX_UDP_CHUNK / MAX_SKBS / MAX_SKB_SIZE macros are private to it. Move them all into drivers/net/netconsole.c. MAX_UDP_CHUNK and MAX_SKB_SIZE were promoted to <linux/netpoll.h> by commit 6c537b845c99 ("netconsole: do not dequeue pooled skbs that cannot satisfy len") so find_skb() could detect oversized requests against the same value refill_skbs() used. With both functions now local to netconsole, the shared definition no longer needs to live in the header. Pure code motion: bodies and pool sizing semantics are unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-5-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move refill_skbs_work_handler() from netpollBreno Leitao
The work handler is wired via INIT_WORK() in netconsole_skb_pool_init() and has no other callers since the previous patch took the skb pool lifecycle out of __netpoll_setup(). Move the function body into drivers/net/netconsole.c as a file-static helper, drop EXPORT_SYMBOL_GPL() and remove the prototype from <linux/netpoll.h>. Pure code motion: the body is unchanged and still calls the exported refill_skbs() in net/core/netpoll.c. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-4-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: take over skb pool lifecycle from netpollBreno Leitao
The fallback skb pool fronted by find_skb() is netconsole's only client: every other netpoll goes through __netpoll_setup() / netpoll_send_skb() without ever touching np->skb_pool. Today __netpoll_setup() and __netpoll_cleanup() create and destroy the pool for everyone, paying ~48 KB of pre-allocated skbs per netpoll instance that only netconsole uses, what a waste! Move the responsibility to netconsole. __netpoll_setup() did this under the RTNL, but netconsole enables targets from enabled_store() / alloc_param_target() without it, while the teardown path flushes the pool (cancel_work_sync() + skb_queue_purge()) under the RTNL from netconsole_process_cleanups_core(). Initialising the queue head and the refill work on every enable would therefore race that flush. They only need initialising once: after a flush the queue head is left valid and empty and cancel_work_sync() leaves the work re-armable. Set them up in alloc_and_init(), while the target is not yet reachable, and let the enable paths only refill the pool via refill_skbs(), which serialises with the flush through skb_pool.lock. See discussions in [1] Link: https://lore.kernel.org/all/alDMvD5S7TZnoD_V@gmail.com/ [1] Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-3-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: clean up released targets dropped before the cleanup workerBreno Leitao
drop_netconsole_target() might eventually tear down a target that netconsole_netdev_event() had moved to target_cleanup_list but that netconsole_process_cleanups_core() had not processed yet. Always cleanup devices that eventually have a device attached to the target, independent of the state. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-1-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()Ivan Vecera
When a dpll_pin is shared across multiple dpll_device instances and those devices are being unregistered (e.g. during driver module removal), a NULL pointer dereference can occur in dpll_msg_add_pin_ref_sync(). This happens under the following conditions: - A pin is registered with two or more dpll devices (dpll_A, dpll_B) - The pin has ref_sync pairs with other pins - During unregistration of dpll_A's pins, a ref_sync partner pin is unregistered first, removing it from dpll_A->pin_refs - But since the partner pin is still registered with dpll_B, its dpll_refs is not empty, so dpll_pin_ref_sync_pair_del() does NOT run and the partner stays in the pin's ref_sync_pins xarray - When the pin itself is then unregistered from dpll_A, the delete notification calls dpll_msg_add_pin_ref_sync() which finds the partner in ref_sync_pins, passes dpll_pin_available() (partner is still registered with dpll_B), but dpll_pin_on_dpll_priv(dpll_A, partner) returns NULL because partner was already removed from dpll_A->pin_refs - The NULL priv pointer is passed to the driver's ref_sync_get callback, which dereferences it BUG: kernel NULL pointer dereference, address: 0000000000000034 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:zl3073x_dpll_input_pin_ref_sync_get+0x73/0x80 [zl3073x] Call Trace: dpll_msg_add_pin_ref_sync+0xb8/0x200 dpll_cmd_pin_get_one+0x3b6/0x4b0 dpll_pin_event_send+0x72/0x140 __dpll_pin_unregister+0x5a/0x2b0 dpll_pin_unregister+0x49/0x70 Fix this by skipping ref_sync pins whose priv pointer cannot be resolved for the current dpll device. Fixes: 58256a26bfb3 ("dpll: add reference sync get/set") Signed-off-by: Ivan Vecera <ivecera@redhat.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260710193625.1378822-1-ivecera@redhat.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17net/mlx5: free mlx5_st_idx_data on final deallocZhiping Zhang
Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints (e.g. churning RDMA MRs) leak one struct mlx5_st_idx_data per cycle; kmemleak flags it as unreferenced and the kmalloc slab grows over time. When the last reference to an ST table entry is dropped, mlx5_st_dealloc_index() removed the entry from idx_xa but the backing mlx5_st_idx_data allocation was never freed. Free idx_data after the xa_erase() so the lifetime of the bookkeeping struct matches the lifetime of the ST entry it tracks. Cc: stable@vger.kernel.org Fixes: 888a7776f4fb ("net/mlx5: Add support for device steering tag") Reviewed-by: Michael Gur <michaelgur@nvidia.com> Signed-off-by: Zhiping Zhang <zhipingz@meta.com> Reviewed-by: Leon Romanovsky <leonro@nvidia.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260702222507.1234467-1-zhipingz@meta.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17Merge tag 'linux-can-fixes-for-7.2-20260716' of ↵Paolo Abeni
git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2026-07-16 this is a pull request of 19 patches for net/main. The first patch is by Alexander Hölzl and fixes the Kconfig description of the vxcan driver. Next patch by Fan Wu fixes the tear down order in the esd_usb driver. Followed by a patch by Oliver Hartkopp that adds missing locking for the raw flags in the CAN_RAW protocol. Shuhao Fu's patch for the j1939 protocol fix lockless local-destination check. Stéphane Grosjean updates their email address. The next 11 patches all target the CAM Broadcast Manager protocol. One contributed by Lee Jones the remaining ones by Oliver Hartkopp. They fix several concurrency and locking issues found by various bots. The last 3 patches are also by Oliver Hartkopp fixing concurrency and locking issues found by various bots in the CAN ISO Transport Protocol. linux-can-fixes-for-7.2-20260716 * tag 'linux-can-fixes-for-7.2-20260716' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: isotp: serialize TX state transitions under so->rx_lock can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER can: isotp: use unconditional synchronize_rcu() in isotp_release() can: bcm: track a single source interface for ANYDEV timeout/throttle ops can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() can: bcm: fix stale rx/tx ops after device removal can: bcm: add missing device refcount for CAN filter removal can: bcm: validate frame length in bcm_rx_setup() for RTR replies can: bcm: extend bcm_tx_lock usage for data and timer updates can: bcm: add missing rcu list annotations and operations can: bcm: fix CAN frame rx/tx statistics can: bcm: add locking when updating filter and timer values can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF can: peak: Modification of references to email accounts being deleted can: j1939: fix lockless local-destination check can: raw: add locking for raw flags bitfield can: esd_usb: kill anchored URBs before freeing netdevs can: vxcan: Kconfig: fix description stating no local echo provided ==================== Link: https://patch.msgid.link/20260716155528.809908-1-mkl@pengutronix.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17cpufreq: Stop using 32-bit MSR interfacesJuergen Gross
The 32-bit MSR interfaces rdmsr() and wrmsr() are planned to be removed. Use the related 64-bit variants instead. Signed-off-by: Juergen Gross <jgross@suse.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com> Cc: Rafael J. Wysocki <rafael@kernel.org> Cc: Viresh Kumar <viresh.kumar@linaro.org> Cc: linux-pm@vger.kernel.org Link: https://patch.msgid.link/20260703112445.1763078-1-jgross@suse.com
2026-07-17intel_idle: Add ACPI _LPI supportRafael J. Wysocki
Allow intel_idle to use idle states information coming from ACPI _LPI objects by making it call acpi_processor_extract_lpi_info() and, if that is successful, using the list of idle states produced by that function instead of the one coming from acpi_processor_evaluate_cst(). Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2280567.Icojqenx9y@rafael.j.wysocki
2026-07-17intel_idle: Prepare for adding ACPI _LPI supportRafael J. Wysocki
In preparation for adding ACPI _LPI support to intel_idle, move some code used for processing ACPI idle states information coming from _CST objects to separate functions because that code will be also used for processing idle states information coming from _LPI. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/1932965.atdPhlSkOF@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Add switch for strict _LPI processingRafael J. Wysocki
Add a "strict" argument to acpi_processor_extract_lpi_info() that, when set, will cause it to ignore _LPI states without minimum residency or wake latency instead of assuming 10 us values for these parameters. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Acked-by: Huisong Li <lihuisong@huawei.com> Link: https://patch.msgid.link/3896986.MHq7AAxBmi@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Relocate acpi_processor_extract_lpi_info()Rafael J. Wysocki
In preparation for adding ACPI _LPI support to the intel_idle driver, move acpi_processor_extract_lpi_info() along with some static functions used by it to the acpi_processor.c file containing the non-modular part of the ACPI processor driver, so it can be called by external non-modular code like intel_idle. However, export it to modules in the ACPI_PROCESSOR_IDLE import namespace so that the modular part of the ACPI processor driver can still invoke it. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Acked-by: Huisong Li <lihuisong@huawei.com> Link: https://patch.msgid.link/2277662.Mh6RI2rZIc@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Introduce acpi_processor_extract_lpi_info()Rafael J. Wysocki
In preparation for adding ACPI _LPI support to the intel_idle driver, move the majority of the acpi_processor_get_lpi_info() function body to a new function called acpi_processor_extract_lpi_info() that will be exported to external code subsequently. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Acked-by: Huisong Li <lihuisong@huawei.com> Link: https://patch.msgid.link/2709187.Lt9SDvczpP@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Introduce too_many_states() for _LPIRafael J. Wysocki
To reduce code duplication, introduce a function called too_many_states() that will check if the total number of _LPI states for a given CPU is too large and print a message in that case. Use that function in flatten_lpi_states() and acpi_processor_get_lpi_info(). No functional impact beyond reducing dynamic debug flexibility. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Acked-by: Huisong Li <lihuisong@huawei.com> Link: https://patch.msgid.link/1964818.CQOukoFCf9@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Rework flatten_lpi_states()Rafael J. Wysocki
Rewrite flatten_lpi_states() to make it easier to follow: * Rename its flat_state_cnt, curr_level and prev_level parameters to state_count, curr, and prev, respectively, so their names match the names of analogous variables in acpi_processor_get_lpi_info(). * Eliminate a redundant local variable state_count. * Move definitions of local variables to the code blocks in which they are used. * Reduce the indentation level in the inner loop. * Use more meaningful names for local variables. * Move two statements that belong in acpi_processor_get_lpi_info() from flatten_lpi_states() to that function. * Use acpi_handle_info() for printing a message when the count of flattened states gets too large and drop the message requesting ACPI_PROCESSOR_MAX_POWER to be adjusted which is pointless. * Add a comment explaining what happens in that function. No intentional functional impact beyond the message printed when the count of flattened states is too large. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Acked-by: Huisong Li <lihuisong@huawei.com> Link: https://patch.msgid.link/2064627.usQuhbGJ8B@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Rearrange loop in acpi_processor_get_lpi_info()Rafael J. Wysocki
Eliminate local variable status (that is redundant) from acpi_processor_get_lpi_info() and make that function call acpi_get_parent() in one place. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Acked-by: Huisong Li <lihuisong@huawei.com> Link: https://patch.msgid.link/1862515.VLH7GnMWUR@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Drop redundant _LPI presence checksRafael J. Wysocki
The acpi_has_method() checks for _LPI in acpi_processor_get_lpi_info() are redundant because acpi_processor_evaluate_lpi() returns an error when _LPI is not present, so drop them. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Acked-by: Huisong Li <lihuisong@huawei.com> Link: https://patch.msgid.link/3349003.5fSG56mABF@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Rework first-level _LPI states processingRafael J. Wysocki
The first-level _LPI states need not be combined with the previous level and the entry method for them cannot be ACPI_CSTATE_INTEGER, so process them directly in acpi_processor_get_lpi_info() instead of doing a special case for them in flatten_lpi_states(). Also bail out if there are no _LPI states at the first level because that means that there are no _LPI states at all. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Link: https://patch.msgid.link/3703077.iIbC2pHGDl@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Rearrange acpi_processor_get_lpi_info()Rafael J. Wysocki
Reorder the definitions of local variables in acpi_processor_get_lpi_info() and drop local variable pr_ahandle that is not really necessary from it. Additionally, move two definitions of local variables to the loop in which they are used and rearrange the code slightly to prepare it for subsequent changes. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Acked-by: Huisong Li <lihuisong@huawei.com> Link: https://patch.msgid.link/7965163.EvYhyI6sBW@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Introduce lpi_state_debug()Rafael J. Wysocki
Add a helper macro called lpi_state_debug() for printing debug messages regarding _LPI states and use it in acpi_processor_evaluate_lpi(). No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2043393.PYKUYFuaPT@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Split acpi_processor_evaluate_lpi()Rafael J. Wysocki
Move individual _LPI state package processing from acpi_processor_evaluate_lpi() to a separate new function called process_lpi_state_package(). No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Acked-by: Huisong Li <lihuisong@huawei.com> Link: https://patch.msgid.link/10878273.nUPlyArG6x@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Rearrange acpi_processor_evaluate_lpi()Rafael J. Wysocki
Rearrange acpi_processor_evaluate_lpi() to make it somewhat easier to follow and diagnose (if need be). In particular: * Rename some local variables and reorder their definitions. * Change the type of local variables used for storing firmware-provided values to unsigned int (they cannot be negative). * Eliminate local variable "loop" that is redundant. * Avoid explicit pointer arithmetic. * Print the correct number of _LPI state packages in the final debug message. No intentional functional impact beyond debug output. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Link: https://patch.msgid.link/3426078.44csPzL39Z@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Unify debug in acpi_processor_evaluate_lpi()Rafael J. Wysocki
Use acpi_handle_debug() consistently for printing debug messages in acpi_processor_evaluate_lpi() because that makes it somewhat easier to identify the source of the problem in the ACPI tables. No intentional functional impact beyond debug output. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Acked-by: Huisong Li <lihuisong@huawei.com> Link: https://patch.msgid.link/3051550.e9J7NaK4W3@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Ignore _LPI states with SYSTEMIO entry methodRafael J. Wysocki
The only entry method for _LPI states supported by acpi_idle_lpi_enter() is FFH and it is better to ignore _LPI states with the SYSTEMIO entry method upfront than return an error from acpi_idle_lpi_enter() on attempts to use them. Update acpi_processor_evaluate_lpi() accordingly. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Acked-by: Huisong Li <lihuisong@huawei.com> Link: https://patch.msgid.link/2268989.irdbgypaU6@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Expand _LPI package sanity checksRafael J. Wysocki
The _LPI package sanity checks in acpi_processor_evaluate_lpi() miss a couple of things, so expand them by adding a buffer size check before retrieving a struct acpi_power_register from it (and skip the given state if the buffer is not large enough to hold a register structure) and making the function avoid copying the state description from the ACPI table if there are too few elements in the package supposed to hold it. While at it, relocate and rephrase a comment about skipping _LPI state package elements [7-8]. Fixes: a36a7fecfe60 ("ACPI / processor_idle: Add support for Low Power Idle(LPI) states") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Acked-by: Huisong Li <lihuisong@huawei.com> Link: https://patch.msgid.link/5084143.GXAFRqVoOG@rafael.j.wysocki
2026-07-17gpio: pcf857x: Use le16_to_cpu() and cpu_to_le16() in IO accessorsAndy Shevchenko
16-bit expander data is an __le16, use le16_to_cpu() to read it. In the similar way use cpu_to_le16() to write __le16 value. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Fixes: and Cc: stable? Link: https://patch.msgid.link/20260715163944.1300616-1-andriy.shevchenko@linux.intel.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-17acpi: Stop using 32-bit MSR interfacesJuergen Gross
The 32-bit MSR interfaces rdmsr(), wrmsr(), rdmsr_safe() and wrmsr_safe() are planned to be removed. Use the related 64-bit variants instead. In processor_throttling.c drop needless initializers. Signed-off-by: Juergen Gross <jgross@suse.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Link: https://patch.msgid.link/20260629060526.3638272-5-jgross@suse.com
2026-07-17powercap: Stop using 32-bit MSR interfacesJuergen Gross
The 32-bit MSR interfaces rdmsr_safe() and wrmsr_safe() are planned to be removed. Use the related 64-bit variants instead. Drop a pointless initializer while at it. Signed-off-by: Juergen Gross <jgross@suse.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Link: https://patch.msgid.link/20260629060526.3638272-3-jgross@suse.com
2026-07-17thermal/intel: Stop using 32-bit MSR interfacesJuergen Gross
The 32-bit MSR interfaces rdmsr(), wrmsr(), rdmsr_safe() and wrmsr_safe() are planned to be removed. Use the related 64-bit variants instead. Signed-off-by: Juergen Gross <jgross@suse.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Link: https://patch.msgid.link/20260703112232.1762925-1-jgross@suse.com
2026-07-17accel/ivpu: Remove unnecessary min_t()/max_t() usageAndrzej Kacprowski
Remove unnecessary min_t()/max_t() usage in ivpu_fw.c and ivpu_mmu_context.c. The min()/max() macros are sufficient as the types are compatible and there is no risk of overflow. Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com> Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com> Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com> Link: https://patch.msgid.link/20260716083350.248419-1-andrzej.kacprowski@linux.intel.com
2026-07-17media: cec/core: add error-inj-tx-timeouts debugfs entryHans Verkuil
Add a new debugfs entry that makes it possible to do error injection of failing the next N transmits by a timeout. This can be used to test what happens in that case during the claiming of a free logical address. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-17media: cec/core: cec-pin: toggle rx_toggle when arb lostHans Verkuil
If we inject an Arbitration Lost error, then manually toggle rx_toggle instead of waiting for cec_pin_to_idle(). When handling the Arbitration Lost error injection we are switching to TX mode, and as a result when cec_pin_to_idle() is called when the transmit ends it would never toggle rx_toggle since it is no longer in RX mode. Without this change the 'any,toggle rx-arb-lost' error injection would, once it is on, always stay on. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-17media: cec/core: add a new CEC_LOG_ADDRS_FL_CONFIG_FAILED flagHans Verkuil
If claiming a logical address fails, then set the CEC_LOG_ADDRS_FL_CONFIG_FAILED flag. This makes it possible for userspace to detect this corner case. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-17media: cec/core: flush stale STATE_CHANGE eventsHans Verkuil
If the physical address becomes invalid, then flush any old STATE_CHANGE events since those are no longer relevant. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-17media: cec/core: drop cec_post_state_event callHans Verkuil
No need to call cec_post_state_event() if the next call is to cec_adap_unconfigure() since that will also call cec_post_state_event(). This fixes the case when, when the physical address is invalidated, you get two CEC_EVENT_STATE_CHANGE events: one with a non-zero log_addr_mask and one with a zero log_addr_mask. You just want to see the event with phys_addr set to f.f.f.f and log_addr_mask set to 0. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-17media: cec/core: handle core events like normal eventsHans Verkuil
Currently there is a distinction between core events (CEC_EVENT_STATE_CHANGE and CEC_EVENT_LOST_MSGS) and other events. The core events do not require memory allocations, so are a bit faster, but they are also limited to just a single event: if a new event comes in, then that replaces the old one. It's all overly complicated, and with only one state change event it is easy to miss state changes. So just drop that optimization, and allow for up to 3 state change events. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-17media: cec/core: drop ABORTED/TIMEOUT checkHans Verkuil
When claiming a logical address, don't break off the process when the transmit returns ABORTED or TIMEOUT. Just do another attempt in that case. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-17media: cec/core: max_retries -> max_attemptsHans Verkuil
Rename max_retries to max_attempts. This counter really is for the number of attempts, not the number of retries. Also increase the number of attempts from 2 to 3. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-17media: cec: tegra_cec: keep track of number of Rx Low DrivesHans Verkuil
Keep track of Rx Low Drive conditions. Useful for detecting potential hardware/cable problems as it suggests unstable or incorrect voltage levels. Note that the Tx Low Drive conditions are already logged in the CEC core. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-17media: cec: tegra_cec: don't break off msg on NACKHans Verkuil
The Tegra CEC hardware has a bug where, if the first attempt to transmit a message is NACKed so the transmit is aborted, then the second attempt can contain corrupt data. Ensure that the full message is always transmitted to avoid hitting this bug. I suspect some internal state is not reset in the case of aborting a message due to a NACK. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-17media: vivid: always allow meta output streamingHans Verkuil
The vivid metadata output emulation only works if the video input is configured for a webcam. That makes no sense, and it is in fact a copy-and-paste from the metadata capture support. Always allow metadata output, just make sure that when the metadata is processed it only sets the brightness/saturation/ hue/contrast controls if they have been defined: if vivid was instantiation without video capture support, then those controls are missing. This change ensures that the test-media regression script correctly tests metadata output streaming. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-17clk: eyeq: Add EyeQ7H compatiblesBenoît Monin
Add the entries for the 14 Other Logic Blocks found in the EyeQ7H SoC. The clock tree is more complex than the previous generation of SoC, as some OLB depend on the clock output of other OLB instead of all referring to the main oscillator. The OLB south, east and west generate those reference clocks used by other blocks. They also use the reference clock internally. The reference clock provided by OLB south is named "ref_100p0", "ref_106p6_e" by OLB east and "ref_106p6_w" by OLB west. For the OLB with a single parent clock, We use the same logic as the blocks found in previous SoC and refer to it with the name "ref". The OLB with two parent clocks use the reference clock provided by the OLB south, east and west as "ref_100p0" and "ref_106p6" and the main oscillator as "ref". The three dividers found in the DDR OLBs are configured by the same register and are declared read-only. The reset controllers found is 11 of the OLB are declared as auxiliary device attached to the clock device. Also add the functions to parse the registers of the two types of PLL in the EyeQ7H OLB. The JFRACR PLL have similar properties as the FRACG PLL, but its configuration is spread on three registers instead of two. It also have a wider fractional part for the multiplier on 24 bits instead of 20. The AINTP PLL does not support spread spectrum and uses a single register. It is registered as a fixed factor without the flag CLK_FIXED_FACTOR_FIXED_ACCURACY and thus inherit the accuracy of its parent clock. The output of these two types of PLL is routed before the post-divisor, similar to the FRACG PLL. Signed-off-by: Benoît Monin <benoit.monin@bootlin.com>
2026-07-17clk: eyeq: Drop PLL, dividers, and fixed factors structsBenoît Monin
Now that there are no users of the eqc_pll, eqc_div, and eqc_fixed_factor structures since they have been converted to eqc_clock, remove these structs and the code related to their parsing in probe and early initialization. Signed-off-by: Benoît Monin <benoit.monin@bootlin.com>
2026-07-17clk: eyeq: Convert clocks declaration to eqc_clockBenoît Monin
Convert all declarations of PLLs, dividers, and fixed factors to struct eqc_clock for the EyeQ5, EyeQ6H, EyeQ6L, and EyeQ6Lplus, both for the match data used during probe and the early match data used in early initialization. Tested on the EyeQ5, EyeQ6H and EyeQ6Lplus evaluation boards. For the EyeQ6Lplus and EyeQ6H, the clock tree is unchanged. For the EyeQ5, this change allows us to set the parent of some probed dividers and fixed factors by name as they refer to clocks registered in early init. While these clocks were previously orphaned, they were not yet used by a peripheral. Signed-off-by: Benoît Monin <benoit.monin@bootlin.com>
2026-07-17clk: eyeq: Introduce a generic clock typeBenoît Monin
Currently, the clocks contained in the OLB are represented as three separate structures: PLL, dividers and fixed factors. These clock objects are stored in three separate arrays in the match data and registered in a fixed order: first the PLL, then the dividers, and finally the fixed factors. While this is sufficient for the clocks found in the OLB of the EyeQ5 and EyeQ6, it does not allow declaring the more complex clock interdependencies for those found in the OLB of the EyeQ7H. We add a new type of clock represented by the struct eqc_clock that covers all types of clocks found in OLB. It contains the clock index and its name, alongside the parent clock index and name. The index refers to the position in the array of clk_hw in the struct clk_hw_onecell_data that is filled when registering the clocks. The parent name is optional and can refer to the parent clock either via the device tree or via its globally unique name. Two special index values are used to select which type of lookup is done. The function eqc_fill_parent_data() fill a clk_parent_data structure based on the parent index and name values. The struct eqc_clock also contains two function pointers: .probe() and .unregister(). The probe() function parses the eqc_clock structure, registers a new clock as a clk_hw and adds it to the clk_hw_onecell_data structure. It can be called during probe and early init. The unregister() function unregisters the clk_hw. This patch adds the probe functions for the PLLs, the dividers and the fixed factors found in the EyeQ OLB. Finally, a union is also part of the eqc_clock structure to store the data specific to each type of clock. To help in declaring struct eqc_clock, three macros are added. They set the correct function pointers for .probe() and .unregister() based on the type of clock being declared. An array of eqc_clock is added to the match data and early match data. They are parsed during probe and early initialization respectively. There is no user yet of the eqc_clock structure. Signed-off-by: Benoît Monin <benoit.monin@bootlin.com>
2026-07-17clk: eyeq: Prefix the PLL registers with the PLL typeBenoît Monin
Rename the PLL registers to make room for other PLL types that are present in the eyeQ7H. Move the access to the PLL register inside the function parsing it as both call sites were doing the same thing. Signed-off-by: Benoît Monin <benoit.monin@bootlin.com>
2026-07-17clk: fixed-factor: Export __clk_hw_register_fixed_factor()Benoît Monin
Make the base registration function for fixed-factor clocks public and re-implement the various registration functions that are a direct call to __clk_hw_register_fixed_factor() as macros. This is similar to how the registration functions of divider, mux and other clocks are implemented. Add a new macro clk_hw_register_fixed_factor_pdata() to register a fixed-factor clock with its parent clock passed as a struct clk_parent_data. Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Benoît Monin <benoit.monin@bootlin.com>
2026-07-17clk: fixed-factor: Rework initialization with parent clocksBenoît Monin
Use the same sequence as clk-divider, clk-gate and other to set the parent_names, parent_hws and parent_data in the init struct when registering a fixed-factor clock. The number of parent clocks is now only set to one if a parent clock is provided. Previously the number of parent clocks was always one, forcing callers of __clk_hw_register_fixed_factor() to provide a dummy parent_data struct with an invalid clock index in case they were not provided with a non-NULL parent_name or parent_hw. Drop this dummy parent_data as is not necessary anymore. This change only has a small impact on mis-configured fixed-factor. Now a call to clk_hw_register_fixed_factor() with a NULL parent will register a fixed-factor with zero parent while previously it was registered with one invalid parent. In both cases the rate of the fixed-factor is 0Hz but it is no longer shown as orphaned. This has no impact on properly configured fixed-factors clocks which have a valid parent set. In clk_factor_determine_rate(), make sure the parent clock is valid before accessing it because the mis-configured fixed-factor now have a NULL parent. Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Benoît Monin <benoit.monin@bootlin.com>