linux-toradex.git/drivers/misc, branch v6.19

mei: trace: treat reg parameter as string

2026-01-16T15:43:47+00:00

The commit
afd2627f727b ("tracing: Check "%s" dereference via the field and not the TP_printk format")
forbids to emit event with a plain char* without a wrapper.

The reg parameter always passed as static string and wrapper
is not strictly required, contrary to dev parameter.
Use the string wrapper anyway to check sanity of the reg parameters,
store it value independently and prevent internal kernel data leaks.

Since some code refactoring has taken place, explicit backporting may
be needed for kernels older than 6.10.

Cc: stable@vger.kernel.org  # v6.11+
Fixes: a0a927d06d79 ("mei: me: add io register tracing")
Signed-off-by: Alexander Usyskin 
Link: https://patch.msgid.link/20260111145125.1754912-1-alexander.usyskin@intel.com
Signed-off-by: Greg Kroah-Hartman

uacce: ensure safe queue release with state management

2026-01-16T15:43:17+00:00

Directly calling `put_queue` carries risks since it cannot
guarantee that resources of `uacce_queue` have been fully released
beforehand. So adding a `stop_queue` operation for the
UACCE_CMD_PUT_Q command and leaving the `put_queue` operation to
the final resource release ensures safety.

Queue states are defined as follows:
- UACCE_Q_ZOMBIE: Initial state
- UACCE_Q_INIT: After opening `uacce`
- UACCE_Q_STARTED: After `start` is issued via `ioctl`

When executing `poweroff -f` in virt while accelerator are still
working, `uacce_fops_release` and `uacce_remove` may execute
concurrently. This can cause `uacce_put_queue` within
`uacce_fops_release` to access a NULL `ops` pointer. Therefore, add
state checks to prevent accessing freed pointers.

Fixes: 015d239ac014 ("uacce: add uacce driver")
Cc: stable@vger.kernel.org
Signed-off-by: Chenghai Huang 
Signed-off-by: Yang Shen 
Acked-by: Zhangfei Gao 
Link: https://patch.msgid.link/20251202061256.4158641-5-huangchenghai2@huawei.com
Signed-off-by: Greg Kroah-Hartman

uacce: implement mremap in uacce_vm_ops to return -EPERM

2026-01-16T15:43:16+00:00

The current uacce_vm_ops does not support the mremap operation of
vm_operations_struct. Implement .mremap to return -EPERM to remind
users.

The reason we need to explicitly disable mremap is that when the
driver does not implement .mremap, it uses the default mremap
method. This could lead to a risk scenario:

An application might first mmap address p1, then mremap to p2,
followed by munmap(p1), and finally munmap(p2). Since the default
mremap copies the original vma's vm_private_data (i.e., q) to the
new vma, both munmap operations would trigger vma_close, causing
q->qfr to be freed twice(qfr will be set to null here, so repeated
release is ok).

Fixes: 015d239ac014 ("uacce: add uacce driver")
Cc: stable@vger.kernel.org
Signed-off-by: Yang Shen 
Signed-off-by: Chenghai Huang 
Acked-by: Zhangfei Gao 
Link: https://patch.msgid.link/20251202061256.4158641-4-huangchenghai2@huawei.com
Signed-off-by: Greg Kroah-Hartman

uacce: fix isolate sysfs check condition

2026-01-16T15:43:16+00:00

uacce supports the device isolation feature. If the driver
implements the isolate_err_threshold_read and
isolate_err_threshold_write callback functions, uacce will create
sysfs files now. Users can read and configure the isolation policy
through sysfs. Currently, sysfs files are created as long as either
isolate_err_threshold_read or isolate_err_threshold_write callback
functions are present.

However, accessing a non-existent callback function may cause the
system to crash. Therefore, intercept the creation of sysfs if
neither read nor write exists; create sysfs if either is supported,
but intercept unsupported operations at the call site.

Fixes: e3e289fbc0b5 ("uacce: supports device isolation feature")
Cc: stable@vger.kernel.org
Signed-off-by: Chenghai Huang 
Acked-by: Zhangfei Gao 
Link: https://patch.msgid.link/20251202061256.4158641-3-huangchenghai2@huawei.com
Signed-off-by: Greg Kroah-Hartman

uacce: fix cdev handling in the cleanup path

2026-01-16T15:43:16+00:00

When cdev_device_add fails, it internally releases the cdev memory,
and if cdev_device_del is then executed, it will cause a hang error.
To fix it, we check the return value of cdev_device_add() and clear
uacce->cdev to avoid calling cdev_device_del in the uacce_remove.

Fixes: 015d239ac014 ("uacce: add uacce driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wenkai Lin 
Signed-off-by: Chenghai Huang 
Acked-by: Zhangfei Gao 
Link: https://patch.msgid.link/20251202061256.4158641-2-huangchenghai2@huawei.com
Signed-off-by: Greg Kroah-Hartman

Merge tag 'char-misc-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-01-11T17:27:44+00:00

Pull char/misc driver fixes from Greg KH:
 "Here are some small char/misc driver fixes for some reported issues.
  Included in here is:

   - much reported rust_binder fix

   - counter driver fixes

   - new device ids for the mei driver

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'char-misc-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  rust_binder: remove spin_lock() in rust_shrink_free_page()
  mei: me: add nova lake point S DID
  counter: 104-quad-8: Fix incorrect return value in IRQ handler
  counter: interrupt-cnt: Drop IRQF_NO_THREAD flag

Merge tag 'soc-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

2026-01-10T01:11:45+00:00

Pull SoC fixes from Arnd Bergmann:
 "The main code change is a revert of the Raspberry Pi RP1 overlay
  support that was decided to not be ready.

  The other fixes are all for devicetree sources:

   - ethernet configuration on ixp42x-actiontec-mi424wr is board
     revision specific

   - validation warning fixes for imx27/imx51/imx6, hikey960 and k3

   - Minor corrections across imx8 boards, addressing all types of
     issues with interrups, dma, ethernet and clock settings, all simple
     one-line changes"

* tag 'soc-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits)
  arm64: dts: hisilicon: hikey960: Drop "snps,gctl-reset-quirk" and "snps,tx_de_emphasis*" properties
  Documentation/process: maintainer-soc: Mark 'make' as commands
  Documentation/process: maintainer-soc: Be more explicit about defconfig
  arm64: dts: mba8mx: Fix Ethernet PHY IRQ support
  arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart
  arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM
  arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells
  arm64: dts: freescale: moduline-display: fix compatible
  dt-bindings: arm: fsl: moduline-display: fix compatible
  ARM: dts: imx6q-ba16: fix RTC interrupt level
  arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position
  arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt
  arm64: dts: add off-on-delay-us for usdhc2 regulator
  arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level
  ARM: dts: nxp: imx: Fix mc13xxx LED node names
  arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP
  MAINTAINERS: Fix a linusw mail address
  arm64: dts: broadcom: rp1: drop RP1 overlay
  arm64: dts: broadcom: bcm2712: fix RP1 endpoint PCI topology
  misc: rp1: drop overlay support
  ...

mei: me: add nova lake point S DID

2025-12-29T10:31:14+00:00

Add Nova Lake S device id.

Cc: stable 
Co-developed-by: Tomas Winkler 
Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Link: https://patch.msgid.link/20251215105915.1672659-1-alexander.usyskin@intel.com
Signed-off-by: Greg Kroah-Hartman

misc: rp1: drop overlay support

2025-12-19T20:42:23+00:00

The RP1 driver can load an overlay at runtime to describe the inner
peripherals. This has led to a lot of confusion regarding the naming
of nodes, their topology and the reclaiming of related node resources.

Since the overlay is currently not fully functional, drop its support
in the driver in favor of the fully described static DT.

This also means that this driver does not depend on CONFIG_PCI_DYNAMIC_OF_NODES
and no longer requires PCI quirks to dynamically create the intermediate
PCI nodes.

Signed-off-by: Andrea della Porta 
Reviewed-by: Rob Herring 
Link: https://lore.kernel.org/r/4b0aa7160877cf128b9bc713776bcac73c46eb24.1766077285.git.andrea.porta@suse.com
Signed-off-by: Florian Fainelli

lkdtm/bugs: Do not confuse the clang/objtool with busy wait loop

2025-12-19T15:09:09+00:00

Since commit eb972eab0794 ("lkdtm/bugs: Add cases for BUG and PANIC
occurring in hardirq context"), building with clang for x86_64 results
in the following warnings:

vmlinux.o: warning: objtool: lkdtm_PANIC_IN_HARDIRQ(): unexpected end of section .text.lkdtm_PANIC_IN_HARDIRQ
vmlinux.o: warning: objtool: lkdtm_BUG_IN_HARDIRQ(): unexpected end of section .text.lkdtm_BUG_IN_HARDIRQ

caused by busy "while (wait_for_...);" loops. Add READ_ONCE() and
cpu_relax() to better indicate the intention and avoid any unwanted
compiler optimisations.

Fixes: eb972eab0794 ("lkdtm/bugs: Add cases for BUG and PANIC occurring in hardirq context")
Reported-by: kernel test robot 
Closes: https://lore.kernel.org/oe-kbuild-all/202512190111.jxFSqxUH-lkp@intel.com/
Signed-off-by: Catalin Marinas