summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-01-29dpaa2-switch: add bounds check for if_id in IRQ handlerJunrui Luo
The IRQ handler extracts if_id from the upper 16 bits of the hardware status register and uses it to index into ethsw->ports[] without validation. Since if_id can be any 16-bit value (0-65535) but the ports array is only allocated with sw_attr.num_ifs elements, this can lead to an out-of-bounds read potentially. Add a bounds check before accessing the array, consistent with the existing validation in dpaa2_switch_rx(). Reported-by: Yuhao Jiang <danisjiang@gmail.com> Reported-by: Junrui Luo <moonafterrain@outlook.com> Fixes: 24ab724f8a46 ("dpaa2-switch: use the port index in the IRQ handler") Signed-off-by: Junrui Luo <moonafterrain@outlook.com> Link: https://patch.msgid.link/SYBPR01MB7881D420AB43FF1A227B84AFAF91A@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: sfp: add quirk for Lantech 8330-265DMarek Behún
Similar to Lantech 8330-262D-E, the Lantech 8330-265D also reports 2500MBd instead of 3125MBd. Also, all 8330-265D report normal RX_LOS in EEPROM, but some signal inverted RX_LOS. We therefore need to ignore RX_LOS on these modules. Signed-off-by: Marek Behún <kabel@kernel.org> Link: https://patch.msgid.link/20260128170044.15576-1-kabel@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29octeontx2-pf: cn10k/cn20k: Update count_eot in NPA_LF_AURA_BATCH_FREE0Geetha sowjanya
This patch updates the count_eot calculation for CN20K devices. Where the count_eot feild extended to 2 bits, while maintaining CN10K compatibility where only bit 0 is used. Signed-off-by: Geetha sowjanya <gakula@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260128022448.4402-1-gakula@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanupZilin Guan
In setup_nic_devices(), the initialization loop jumps to the label setup_nic_dev_free on failure. The current cleanup loop while(i--) skip the failing index i, causing a memory leak. Fix this by changing the loop to iterate from the current index i down to 0. Compile tested only. Issue found using code review. Fixes: 846b46873eeb ("liquidio CN23XX: VF offload features") Suggested-by: Simon Horman <horms@kernel.org> Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Link: https://patch.msgid.link/20260128154440.278369-4-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanupZilin Guan
In setup_nic_devices(), the initialization loop jumps to the label setup_nic_dev_free on failure. The current cleanup loop while(i--) skip the failing index i, causing a memory leak. Fix this by changing the loop to iterate from the current index i down to 0. Also, decrement i in the devlink_alloc failure path to point to the last successfully allocated index. Compile tested only. Issue found using code review. Fixes: f21fb3ed364b ("Add support of Cavium Liquidio ethernet adapters") Suggested-by: Simon Horman <horms@kernel.org> Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Link: https://patch.msgid.link/20260128154440.278369-3-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: liquidio: Initialize netdev pointer before queue setupZilin Guan
In setup_nic_devices(), the netdev is allocated using alloc_etherdev_mq(). However, the pointer to this structure is stored in oct->props[i].netdev only after the calls to netif_set_real_num_rx_queues() and netif_set_real_num_tx_queues(). If either of these functions fails, setup_nic_devices() returns an error without freeing the allocated netdev. Since oct->props[i].netdev is still NULL at this point, the cleanup function liquidio_destroy_nic_device() will fail to find and free the netdev, resulting in a memory leak. Fix this by initializing oct->props[i].netdev before calling the queue setup functions. This ensures that the netdev is properly accessible for cleanup in case of errors. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: c33c997346c3 ("liquidio: enhanced ethtool --set-channels feature") Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Link: https://patch.msgid.link/20260128154440.278369-2-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29Merge tag 'wireless-next-2026-01-29' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Another fairly large set of changes, notably: - cfg80211/mac80211 - most of EPPKE/802.1X over auth frames support - additional FTM capabilities - split up drop reasons better, removing generic RX_DROP - NAN cleanups/fixes - ath11k: - support for Channel Frequency Response measurement - ath12k: - support for the QCC2072 chipset - iwlwifi: - partial NAN support - UNII-9 support - some UHR/802.11bn FW APIs - remove most of MLO/EHT from iwlmvm (such devices use iwlmld) - rtw89: - preparations for RTL8922DE support * tag 'wireless-next-2026-01-29' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (184 commits) wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() wifi: mac80211: use u64_stats_t with u64_stats_sync properly wifi: p54: Fix memory leak in p54_beacon_update() wifi: cfg80211: treat deprecated INDOOR_SP_AP_OLD control value as LPI mode wifi: rtw88: sdio: Migrate to use sdio specific shutdown function wifi: rsi: sdio: Migrate to use sdio specific shutdown function sdio: Provide a bustype shutdown function wifi: nl80211/cfg80211: support operating as RSTA in PMSR FTM request wifi: nl80211/cfg80211: add negotiated burst period to FTM result wifi: nl80211/cfg80211: clarify periodic FTM parameters for non-EDCA based ranging wifi: nl80211/cfg80211: add new FTM capabilities wifi: iwlwifi: rename struct iwl_mcc_allowed_ap_type_cmd::offset_map wifi: iwlwifi: mvm: Remove link_id from time_events wifi: iwlwifi: mld: change cluster_id type to u8 array wifi: iwlwifi: support V13 of iwl_lari_config_change_cmd wifi: iwlwifi: split bios_value_u32 to separate the header wifi: iwlwifi: uefi: cache the DSM functions wifi: iwlwifi: acpi: cache the DSM functions wifi: iwlwifi: mvm: Cleanup MLO code ... ==================== Link: https://patch.msgid.link/20260129110136.176980-39-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: phy: air_en8811h: Add clk provider for an8811hbBjørn Mork
Implement clk provider driver so we can disable the clock output when it isn't needed. This helps to reduce EMF noise Signed-off-by: Bjørn Mork <bjorn@mork.no> Link: https://patch.msgid.link/20260127125547.1475164-4-bjorn@mork.no Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: phy: air_en8811h: add Airoha AN8811HB supportBjørn Mork
The Airoha AN8811HB is mostly compatible with the EN8811H, adding 10Base-T support and reducing power consumption. This driver is based on the air_an8811hb v0.0.4 out-of-tree driver written by "Lucien.Jheng <lucien.jheng@airoha.com>" Firmware is available in linux-firmware. The driver has been tested with firmware version 25110702 Signed-off-by: Bjørn Mork <bjorn@mork.no> Link: https://patch.msgid.link/20260127125547.1475164-3-bjorn@mork.no Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: phy: air_en8811h: factor out shareable codeBjørn Mork
Create reusable helpers in preparation for the AN8811HB support. Signed-off-by: Bjørn Mork <bjorn@mork.no> Link: https://patch.msgid.link/20260127125547.1475164-2-bjorn@mork.no Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30Merge tag 'drm-xe-next-fixes-2026-01-29' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next - Reduce LRC timestamp stuck message on VFs to notice (Brost) - Disable GuC Power DCC strategy on PTL (Vinay) - Unregister drm device on probe error (Lin) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/aXuyrtsnlAOmj_OB@intel.com
2026-01-30Merge tag 'drm-misc-next-fixes-2026-01-29' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Two fixes for NULL pointer dereference in imx8 following the bridge refcounting conversions, and one for the bridge connector following the HDMI audio reworks. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@redhat.com> Link: https://patch.msgid.link/20260129-efficient-jerboa-of-ecstasy-822832@houat
2026-01-29ublk: restore auto buf unregister refcount optimizationCaleb Sander Mateos
Commit 1ceeedb59749 ("ublk: optimize UBLK_IO_UNREGISTER_IO_BUF on daemon task") optimized ublk request buffer unregistration to use a non-atomic reference count decrement when performed on the ublk_io's daemon task. The optimization applied to auto buffer unregistration, which happens as part of handling UBLK_IO_COMMIT_AND_FETCH_REQ on the daemon task. However, commit b749965edda8 ("ublk: remove ublk_commit_and_fetch()") reordered the ublk_sub_req_ref() for the completed request before the io_buffer_unregister_bvec() call. As a result, task_registered_buffers is already 0 when io_buffer_unregister_bvec() calls ublk_io_release() and the non-atomic refcount optimization doesn't apply. Move the io_buffer_unregister_bvec() call back to before ublk_need_complete_req() to restore the reference counting optimization. Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Fixes: b749965edda8 ("ublk: remove ublk_commit_and_fetch()") Reviewed-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-29eth: bnxt: make sure we populate the qcfg defaults on old FW/HWJakub Kicinski
The driver now depends on the core to tell it what the rx page size should be for the agg ring. We must populate the ndo_default_qcfg callback even if we don't support any queue ops. This fixes: Oops: divide error: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN RIP: 0010:bnxt_alloc_rx_page_pool (drivers/net/ethernet/broadcom/bnxt/bnxt.c:3852) with fw version 225.1.109.0. Link: https://lore.kernel.org/20250421222827.283737-20-kuba@kernel.org Fixes: f96e1b35779e ("eth: bnxt: support qcfg provided rx page size") Reviewed-by: Michael Chan <michael.chan@broadcom.com> Link: https://patch.msgid.link/20260128193258.125274-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29hinic3: RQ use RQ_CTXT_PREF_CI_HI instead of SQ_CTXT_PREF_CI_HIFan Gong
Separate the CTX_PREF_CI_HI of rq and sq to improve readability. Co-developed-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Fan Gong <gongfan1@huawei.com> Link: https://patch.msgid.link/7b34bf318c64398f34048c823c15b2eec5a679bc.1769656467.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29hinic3: Use array_size instead of multiplyingFan Gong
Since commit 17fcb3dc12bb ("hinic3: module initialization and tx/rx logic") use "size * sizeof(u64)" in hinic3_feature_nego. Use array_size instead of multiplying can make it clearer. Link: https://lore.kernel.org/netdev/20250911123120.GG30363@horms.kernel.org/ Co-developed-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Fan Gong <gongfan1@huawei.com> Reviewed-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/b7d6d384ccc0bd4c0d3e7af1f90901d589cbd0b1.1769656467.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29hinic3: Remove defensive txq_num checkFan Gong
Since commit 1f3838b84a63 ("hinic3: Add Rss function") nic_dev->num_txqs cannot be zero in hinic3_alloc_txqs(). So remove the check for this case. Link: https://lore.kernel.org/netdev/20250902180843.5ba05bf2@kernel.org/ Co-developed-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Fan Gong <gongfan1@huawei.com> Link: https://patch.msgid.link/c23daa9b79fa731c1caaec9b8245f6b2c4994afb.1769656467.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29hinic3: Fix code Style(remove empty lines between error handling)Fan Gong
According to previous review comment, fix code style of removing empty lines between the actions on the error handling path to make it more idiomatic in the merged code. Link: https://lore.kernel.org/netdev/20250902180937.4c8d9eb3@kernel.org/ Co-developed-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Zhu Yikai <zhuyikai1@h-partners.com> Signed-off-by: Fan Gong <gongfan1@huawei.com> Link: https://patch.msgid.link/ccff2ae7abe91bb3618ded9bb5ef2dc9cb243d22.1769656467.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29octeontx2-af: Workaround SQM/PSE stalls by disabling stickyGeetha sowjanya
NIX SQ manager sticky mode is known to cause stalls when multiple SQs share an SMQ and transmit concurrently. Additionally, PSE may deadlock on transitions between sticky and non-sticky transmissions. There is also a credit drop issue observed when certain condition clocks are gated. work around these hardware errata by: - Disabling SQM sticky operation: - Clear TM6 (bit 15) - Clear TM11 (bit 14) - Disabling sticky → non-sticky transition path that can deadlock PSE: - Clear TM5 (bit 23) - Preventing credit drops by keeping the control-flow clock enabled: - Set TM9 (bit 21) These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this configuration the SQM/PSE maintain forward progress under load without credit loss, at the cost of disabling sticky optimizations. Signed-off-by: Geetha sowjanya <gakula@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zeroJunrui Luo
The driver allocates arrays for ports, FDBs, and filter blocks using kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the device reports zero interfaces (either due to hardware configuration or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10) instead of NULL. Later in dpaa2_switch_probe(), the NAPI initialization unconditionally accesses ethsw->ports[0]->netdev, which attempts to dereference ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic. Add a check to ensure num_ifs is greater than zero after retrieving device attributes. This prevents the zero-sized allocations and subsequent invalid pointer dereference. Reported-by: Yuhao Jiang <danisjiang@gmail.com> Reported-by: Junrui Luo <moonafterrain@outlook.com> Fixes: 0b1b71370458 ("staging: dpaa2-switch: handle Rx path on control interface") Signed-off-by: Junrui Luo <moonafterrain@outlook.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/SYBPR01MB7881BEABA8DA896947962470AF91A@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: stmmac: rk: add SoC specific ->init() methodRussell King (Oracle)
Add a SoC specific init method. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1vl3G5-00000006v3X-2zfD@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: stmmac: rk: add GMAC_CLK_xx constants, simplify RGMII definitionsRussell King (Oracle)
All the definitions of the RGMII related xxx_GMAC_CLK_xxx definitions use the same field values to select the clock rate. Provide common definitions for these field values, passing them in to a single macro for each variant that generates the appropriate values for the speed register. No change to produced code on aarch64. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/E1vl3G0-00000006v3R-2ZBc@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: stmmac: rk: fix missing reset_control_put()Russell King (Oracle)
rk_gmac_setup() delves into the PHY's DT node to retrieve its reset control using of_reset_control_get(). However, it never releases it when the driver is removed. Add reset_control_put() to rk_gmac_exit() to clean this up. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Link: https://patch.msgid.link/E1vl3Fv-00000006v3L-215v@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: phylink: fix NULL pointer deref in phylink_major_config()Russell King (Oracle)
When a MAC driver returns a PCS for an interface mode, and then we attempt to switch to a different mode that doesn't require a PCS, this causes phylink to oops: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 Mem abort info: ESR = 0x0000000096000044 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000137f96000 [0000000000000010] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000044 [#1] SMP Modules linked in: -- CPU: 1 UID: 0 PID: 55 Comm: kworker/u33:0 Not tainted 6.19.0-rc5-00581-g73cb8467a63e #1 PREEMPT Hardware name: Qualcomm Technologies, Inc. Lemans Ride Rev3 (DT) Workqueue: events_power_efficient phylink_resolve pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS +BTYPE=--) pc : phylink_major_config+0x408/0x948 lr : phylink_major_config+0x3fc/0x948 sp : ffff800080353c60 x29: ffff800080353cb0 x28: ffffb305068a8a00 x27: ffffb305068a8000 x26: ffff000080092100 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000000000001 x22: 0000000000000000 x21: ffffb3050555b3d0 x20: ffff800080353d10 x19: ffff0000b6059400 x18: 00000000ffffffff x17: 74756f2f79687020 x16: ffffb305045e4f18 x15: 6769666e6f632072 x14: 6f6a616d203a3168 x13: 782d657361623030 x12: ffffb305068c6a98 x11: 0000000000000583 x10: 0000000000000018 x9 : ffffb305068c6a98 x8 : 0000000100006583 x7 : 0000000000000000 x6 : ffff00008083cc40 x5 : ffff00008083cc40 x4 : 0000000000000001 x3 : 0000000000000001 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000b269e5a8 Call trace: phylink_major_config+0x408/0x948 (P) phylink_resolve+0x294/0x6e4 process_one_work+0x148/0x28c worker_thread+0x2d8/0x3d8 kthread+0x134/0x208 ret_from_fork+0x10/0x20 Code: d63f0020 f9400e60 b4000040 f900081f (f9000ad3) ---[ end trace 0000000000000000 ]--- This is caused by "pcs" being NULL when we attempt to execute: pcs->phylink = pl; Make this conditional on pcs being non-null. Fixes: 486dc391ef43 ("net: phylink: allow mac_select_pcs() to remove a PCS") Reported-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1vl39Q-00000006utm-229h@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: stmmac: report active PHY interfaceRussell King (Oracle)
Report the active PHY interface from the point of view of the dwmac hardware to the kernel log, where the core supports reading this. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/E1vl36F-00000006url-1fWA@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: stmmac: thead: avoid conflicts with PHY_INTF_* definitionsRussell King (Oracle)
Avoid conflicts between stmmac PHY_INTF_* and GMAC_INTF_CTRL register definitions by replacing the PHY_ prefix with GMAC_. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/E1vl36A-00000006urf-19ox@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29net: stmmac: qcom-ethqos: remove mac_baseRussell King (Oracle)
In commit 9b443e58a896 ("net: stmmac: qcom-ethqos: remove MAC_CTRL_REG modification"), ethqos->mac_base is only written, never read. Let's remove it. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1vl39x-00000006uvc-0A3S@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29octeontx2-pf: Fix header guard comment in otx2_devlink.hAlok Tiwari
The closing #endif comment in otx2_devlink.h refers to RVU_DEVLINK_H, but the actual header guard is OTX2_DEVLINK_H. Fix the comment to match the correct header guard name. Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260127174333.1247747-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-29dpll: expose fractional frequency offset in pptIvan Vecera
Currently, the dpll subsystem exports the fractional frequency offset (FFO) in parts per million (ppm). This granularity is insufficient for high-precision synchronization scenarios which often require parts per trillion (ppt) resolution. Add a new netlink attribute DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT to expose the FFO in ppt. Update the dpll netlink core to expect the driver-provided FFO value to be in ppt. To maintain backward compatibility with existing userspace tools, populate the legacy DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET attribute by dividing the new ppt value by 1,000,000. Update the zl3073x and mlx5 drivers to provide the FFO value in ppt: - zl3073x: adjust the fixed-point calculation to produce ppt (10^12) instead of ppm (10^6). - mlx5: scale the existing ppm value by 1,000,000. Signed-off-by: Ivan Vecera <ivecera@redhat.com> Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260126162253.27890-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30Merge tag 'drm-intel-next-fixes-2026-01-29' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - Prevent u64 underflow in intel_fbc_stolen_end Signed-off-by: Dave Airlie <airlied@redhat.com> From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Link: https://patch.msgid.link/aXsWGWjacEJ03rTs@jlahtine-mobl
2026-01-30Merge tag 'drm-misc-fixes-2026-01-29' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.19-rc8: - Fix a WARN_ON() when passing an invalid handle to drm_gem_change_handle_ioctl() - drop ddc device reference when unloading in imx/tve. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/a34d967e-b111-4b29-8c97-af3e77b5d33e@linux.intel.com
2026-01-30gpu: nova-core: remove imports available via preludeGary Guo
These imports are already in scope by importing `kernel::prelude::*` and does not need to be imported separately. Signed-off-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260123172007.136873-2-gary@garyguo.net Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-01-29Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-6.19-rc8). No adjacent changes, conflicts: drivers/net/ethernet/spacemit/k1_emac.c 2c84959167d64 ("net: spacemit: Check for netif_carrier_ok() in emac_stats_update()") f66086798f91f ("net: spacemit: Remove broken flow control support") https://lore.kernel.org/aXjAqZA3iEWD_DGM@sirena.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30Merge tag 'amd-drm-fixes-6.19-2026-01-29' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.19-2026-01-29: amdgpu: - SMU 13 fixes - SMU 14 fixes - GPUVM fault filter fix - Powergating fix - HDMI debounce fix - Xclk fix for soc21 APUs - Fix COND_EXEC handling for GC 11 - GC 10-12 KGQ init fixes - GC 11-12 KGQ reset fixes Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260129212518.22274-1-alexander.deucher@amd.com
2026-01-29misc: pci_endpoint_test: Add BAR subrange mapping test caseKoichiro Den
Add a new PCITEST_BAR_SUBRANGE ioctl to exercise EPC BAR subrange mapping end-to-end. The test programs a simple 2-subrange layout on the endpoint (via pci-epf-test) and verifies that: - the endpoint-provided per-subrange signature bytes are observed at the expected PCIe BAR offsets, and - writes to each subrange are routed to the correct backing region (i.e. the submap order is applied rather than accidentally working due to an identity mapping). Return -EOPNOTSUPP when the endpoint does not advertise subrange mapping, -ENODATA when the BAR is disabled, and -EBUSY when the BAR is reserved for the test register space. Signed-off-by: Koichiro Den <den@valinux.co.jp> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260124145012.2794108-8-den@valinux.co.jp
2026-01-29PCI: endpoint: pci-epf-test: Add BAR subrange mapping test supportKoichiro Den
Extend pci-epf-test so that pci_endpoint_test can exercise BAR subrange mapping end-to-end. Add BAR_SUBRANGE_SETUP/CLEAR commands that program (and tear down) a simple 2-subrange layout for a selected BAR. The endpoint deliberately permutes the physical backing regions (swap the halves) and writes a deterministic signature byte per subrange. This allows the RC to verify that the submap order is actually applied, not just that reads/writes work with an identity mapping. Advertise CAP_SUBRANGE_MAPPING only when the underlying EPC supports dynamic_inbound_mapping and subrange_mapping. Also bump the default BAR sizes (BAR0-4) to 128 KiB so that split subranges are large enough to satisfy common inbound-translation alignment constraints. E.g. for DWC EP, the default and maximum CX_ATU_MIN_REGION_SIZE is 64 kB, so 128 KiB is sufficient for DWC-based EP platforms for 2-subrange testing. Signed-off-by: Koichiro Den <den@valinux.co.jp> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260124145012.2794108-7-den@valinux.co.jp
2026-01-29PCI: dwc: ep: Support BAR subrange inbound mapping via Address Match Mode iATUKoichiro Den
Extend dw_pcie_ep_set_bar() to support inbound mappings for BAR subranges using Address Match Mode IB iATU when pci_epf_bar.num_submap is non-zero. Rename the existing BAR-match helper into dw_pcie_ep_ib_atu_bar() and introduce dw_pcie_ep_ib_atu_addr() for Address Match Mode. When num_submap is non-zero, read the assigned BAR base address and program one inbound iATU window per subrange. Validate the submap array before programming: - each subrange is aligned to pci->region_align - subranges cover the whole BAR (no gaps and no overlaps) Track Address Match Mode mappings and tear them down on clear_bar() and on set_bar() error paths to avoid leaving half-programmed state or untranslated BAR holes. Advertise this capability by extending the common feature bit initializer macro (DWC_EPC_COMMON_FEATURES). This enables multiple inbound windows within a single BAR, which is useful on platforms where usable BARs are scarce but EPFs need multiple inbound regions. Signed-off-by: Koichiro Den <den@valinux.co.jp> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Niklas Cassel <cassel@kernel.org> Link: https://patch.msgid.link/20260124145012.2794108-5-den@valinux.co.jp
2026-01-30Merge tag 'drm-xe-fixes-2026-01-29' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Skip address copy for sync-only execs (Lin) - Fix a WA (Tvrtko) - Derive mem_copy cap from graphics version (Nitin) - Fix is_bound() pci_dev lifetime (Lin) - xe nvm cleanup fixes (Lin) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/aXu_JzBFb9YVFYW1@fedora
2026-01-29Merge tag 'pm-6.19-rc8' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "This adds a terminating NULL entry to an of_device_id table in the qcom-nvmem cpufreq driver to avoid out-of-bounds access (Pei Xiao)" * tag 'pm-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: qcom-nvmem: add sentinel to qcom_cpufreq_ipq806x_match_list
2026-01-29Merge tag 'intel-pinctrl-v6.20-2' of ↵Linus Walleij
git://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/intel into devel intel-pinctrl for v6.20-2 * Remove duplicate error messages when registering pin control * Miscellaneous changes Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-01-29Merge tag 'mtd/fixes-for-6.19-rc8' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD fix from Miquel Raynal: "A single late MTD fix, which reverts a fix that turned out to be incorrect. The observations of the committer was that the number of IDs to be used to probe a chip was incorrect. It happened to be a limitation of his controller, not a chip issue. Restore the chip description, a solution must be found somewhere else" * tag 'mtd/fixes-for-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: Revert "mtd: spinand: esmt: fix id code for F50D1G41LB"
2026-01-29hisi_acc_vfio_pci: fix the queue parameter anomaly issueLongfang Liu
When the number of QPs initialized by the device, as read via vft, is zero, it indicates either an abnormal device configuration or an abnormal read result. Returning 0 directly in this case would allow the live migration operation to complete successfully, leading to incorrect parameter configuration after migration and preventing the service from recovering normal functionality. Therefore, in such situations, an error should be returned to roll back the live migration operation. Signed-off-by: Longfang Liu <liulongfang@huawei.com> Link: https://lore.kernel.org/r/20260122020205.2884497-5-liulongfang@huawei.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-01-29hisi_acc_vfio_pci: resolve duplicate migration statesLongfang Liu
In special scenarios involving duplicate migrations, after the first migration is completed, if the original VF device is used again and then migrated to another destination, the state indicating data migration completion for the VF device is not reset. This results in the second migration to the destination being skipped without performing data migration. After the modification, it ensures that a complete data migration is performed after the subsequent migration. Signed-off-by: Longfang Liu <liulongfang@huawei.com> Link: https://lore.kernel.org/r/20260122020205.2884497-4-liulongfang@huawei.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-01-29hisi_acc_vfio_pci: update status after RAS errorLongfang Liu
After a RAS error occurs on the accelerator device, the accelerator device will be reset. The live migration state will be abnormal after reset, and the original state needs to be restored during the reset process. Therefore, reset processing needs to be performed in a live migration scenario. Signed-off-by: Longfang Liu <liulongfang@huawei.com> Link: https://lore.kernel.org/r/20260122020205.2884497-3-liulongfang@huawei.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-01-29hisi_acc_vfio_pci: fix VF reset timeout issueWeili Qian
If device error occurs during live migration, qemu will reset the VF. At this time, VF reset and device reset are performed simultaneously. The VF reset will timeout. Therefore, the QM_RESETTING flag is used to ensure that VF reset and device reset are performed serially. Fixes: b0eed085903e ("hisi_acc_vfio_pci: Add support for VFIO live migration") Signed-off-by: Weili Qian <qianweili@huawei.com> Link: https://lore.kernel.org/r/20260122020205.2884497-2-liulongfang@huawei.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-01-29PCI/pwrctrl: Create pwrctrl device if graph port is foundManivannan Sadhasivam
The devicetree node of the PCIe Root Port/Slot could have the graph port to link the PCIe M.2 connector node. Since the M.2 connectors are modeled as Power Sequencing devices, they need to be controlled by the pwrctrl driver like the Root Port/Slot supplies. Hence, create the pwrctrl device if the graph port is found in the node. Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Link: https://patch.msgid.link/20260128-pci-m2-v7-2-9b3a5fe3d244@oss.qualcomm.com
2026-01-29drm/xe/nvm: Fix double-free on aux add failureShuicheng Lin
After a successful auxiliary_device_init(), aux_dev->dev.release (xe_nvm_release_dev()) is responsible for the kfree(nvm). When there is failure with auxiliary_device_add(), driver will call auxiliary_device_uninit(), which call put_device(). So that the .release callback will be triggered to free the memory associated with the auxiliary_device. Move the kfree(nvm) into the auxiliary_device_init() failure path and remove the err goto path to fix below error. " [ 13.232905] ================================================================== [ 13.232911] BUG: KASAN: double-free in xe_nvm_init+0x751/0xf10 [xe] [ 13.233112] Free of addr ffff888120635000 by task systemd-udevd/273 [ 13.233120] CPU: 8 UID: 0 PID: 273 Comm: systemd-udevd Not tainted 6.19.0-rc2-lgci-xe-kernel+ #225 PREEMPT(voluntary) ... [ 13.233125] Call Trace: [ 13.233126] <TASK> [ 13.233127] dump_stack_lvl+0x7f/0xc0 [ 13.233132] print_report+0xce/0x610 [ 13.233136] ? kasan_complete_mode_report_info+0x5d/0x1e0 [ 13.233139] ? xe_nvm_init+0x751/0xf10 [xe] ... " v2: drop err goto path. (Alexander) Fixes: 7926ba2143d8 ("drm/xe: defer free of NVM auxiliary container to device release callback") Reviewed-by: Nitin Gote <nitin.r.gote@intel.com> Reviewed-by: Brian Nguyen <brian3.nguyen@intel.com> Cc: Alexander Usyskin <alexander.usyskin@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Suggested-by: Brian Nguyen <brian3.nguyen@intel.com> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com> Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Link: https://patch.msgid.link/20260120183239.2966782-7-shuicheng.lin@intel.com (cherry picked from commit a3187c0c2bbd947ffff97f90d077ac88f9c2a215) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-01-29drm/xe/nvm: Manage nvm aux cleanup with devresShuicheng Lin
Move nvm teardown to a devm-managed action registered from xe_nvm_init(). This ensures the auxiliary NVM device is deleted on probe failure and device detach without requiring explicit calls from remove paths. As part of this, drop xe_nvm_fini() from xe_device_remove() and from the survivability sysfs teardown, and remove the public xe_nvm_fini() API from the header. This is to fix below warn message when there is probe failure after xe_nvm_init(), then xe_device_probe() is called again: " [ 207.318152] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:01.0/0000:03:00.0/xe.nvm.768' [ 207.318157] CPU: 5 UID: 0 PID: 10261 Comm: modprobe Tainted: G B W 6.19.0-rc2-lgci-xe-kernel+ #223 PREEMPT(voluntary) [ 207.318160] Tainted: [B]=BAD_PAGE, [W]=WARN [ 207.318161] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 0812 02/24/2023 [ 207.318163] Call Trace: [ 207.318163] <TASK> [ 207.318165] dump_stack_lvl+0xa0/0xc0 [ 207.318170] dump_stack+0x10/0x20 [ 207.318171] sysfs_warn_dup+0xd5/0x110 [ 207.318175] sysfs_create_dir_ns+0x1f6/0x280 [ 207.318177] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 207.318179] ? lock_acquire+0x1a4/0x2e0 [ 207.318182] ? __kasan_check_read+0x11/0x20 [ 207.318185] ? do_raw_spin_unlock+0x5c/0x240 [ 207.318187] kobject_add_internal+0x28d/0x8e0 [ 207.318189] kobject_add+0x11f/0x1f0 [ 207.318191] ? __pfx_kobject_add+0x10/0x10 [ 207.318193] ? lockdep_init_map_type+0x4b/0x230 [ 207.318195] ? get_device_parent.isra.0+0x43/0x4c0 [ 207.318197] ? kobject_get+0x55/0xf0 [ 207.318199] device_add+0x2d7/0x1500 [ 207.318201] ? __pfx_device_add+0x10/0x10 [ 207.318203] ? lockdep_init_map_type+0x4b/0x230 [ 207.318205] __auxiliary_device_add+0x99/0x140 [ 207.318208] xe_nvm_init+0x7a2/0xef0 [xe] [ 207.318333] ? xe_devcoredump_init+0x80/0x110 [xe] [ 207.318452] ? __devm_add_action+0x82/0xc0 [ 207.318454] ? fs_reclaim_release+0xc0/0x110 [ 207.318457] xe_device_probe+0x17dd/0x2c40 [xe] [ 207.318574] ? __pfx___drm_dev_dbg+0x10/0x10 [ 207.318576] ? add_dr+0x180/0x220 [ 207.318579] ? __pfx___drmm_mutex_release+0x10/0x10 [ 207.318582] ? __pfx_xe_device_probe+0x10/0x10 [xe] [ 207.318697] ? xe_pm_init_early+0x33a/0x410 [xe] [ 207.318850] xe_pci_probe+0x936/0x1250 [xe] [ 207.318999] ? lock_acquire+0x1a4/0x2e0 [ 207.319003] ? __pfx_xe_pci_probe+0x10/0x10 [xe] [ 207.319151] local_pci_probe+0xe6/0x1a0 [ 207.319154] pci_device_probe+0x523/0x840 [ 207.319157] ? __pfx_pci_device_probe+0x10/0x10 [ 207.319159] ? sysfs_do_create_link_sd.isra.0+0x8c/0x110 [ 207.319162] ? sysfs_create_link+0x48/0xc0 ... " Fixes: c28bfb107dac ("drm/xe/nvm: add on-die non-volatile memory device") Reviewed-by: Alexander Usyskin <alexander.usyskin@intel.com> Reviewed-by: Brian Nguyen <brian3.nguyen@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Riana Tauro <riana.tauro@intel.com> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com> Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Link: https://patch.msgid.link/20260120183239.2966782-6-shuicheng.lin@intel.com (cherry picked from commit 11035eab1b7d88daa7904440046e64d3810b1ca1) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-01-29mtd: spinand: add Foresee F35SQB002G flash supportMikhail Kshevetskiy
Add support of Foresee F35SQB002G spinand flash Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-01-29mtd: spinand: winbond: W35N octal DTR supportMiquel Raynal
Extend the support for the W35N chip family by supporting the ODTR bus interface. The chip is capable to run in this mode, which brings a significant performance improvement. 1S-8S-8S: # flash_speed /dev/mtd0 -c1 -d eraseblock write speed is 7529 KiB/s eraseblock read speed is 15058 KiB/s 8D-8D-8D: # flash_speed /dev/mtd0 -c1 -d eraseblock write speed is 9481 KiB/s eraseblock read speed is 23272 KiB/s This is +55% read speed and +26% write speed with the same hardware. Tests have been conducted with a TI AM62A7 using the Cadence quad SPI controller. Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
generated by cgit v1.2.3 (git 2.0.4) at 2026-02-20 14:09:09 +0000