summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
13 daysppp_synctty: ensure a writeable skb headerQingfang Deng
ppp_sync_txmunge() checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP channel bridging without passing through ppp_start_xmit(), which calls skb_cow_head(). For example, a PPPoE frame may share its buffer with a clone queued to an AF_PACKET socket. If it is bridged to a synchronous tty channel, the address/control bytes can overwrite data still visible to that socket. Use skb_cow_head() to ensure both sufficient headroom and a writable header. Fixes: 4cf476ced45d ("ppp: add PPPIOCBRIDGECHAN and PPPIOCUNBRIDGECHAN ioctls") Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260908072135.877364-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysscsi: ibmvfc: Add Kconfig dependency to fix link failure when NVME_FC=mVenkat Rao Bagalkote
Building with CONFIG_SCSI_IBMVFC=y and CONFIG_NVME_FC=m results in a link failure: ibmvfc-nvme.o: undefined reference to `nvme_fc_register_localport' ibmvfc-nvme.o: undefined reference to `nvme_fc_register_remoteport' ibmvfc-nvme.o: undefined reference to `nvme_fc_unregister_localport' ibmvfc-nvme.o: undefined reference to `nvme_fc_unregister_remoteport' ibmvfc-core.o: undefined reference to `nvme_fc_rescan_remoteport' IS_ENABLED() evaluates to 1 for both =y and =m, so the nvme_fc_* call sites are kept in the object file. When SCSI_IBMVFC=y (built-in) but NVME_FC=m (loadable module), the linker cannot resolve these symbols at vmlinux link time. Add the same "depends on NVME_FC || NVME_FC=n" constraint already used by SCSI_LPFC to prevent this configuration. Reported-by: Pavithra <pavrampu@linux.ibm.com> Closes: https://lore.kernel.org/all/327877a29337aa526cc50ac88fbddb86@linux.ibm.com/ Signed-off-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Tested-by: Pavithra <pavrampu@linux.ibm.com> Acked-by: Tyrel Datwyler <tyreld@linux.ibm.com> Link: https://patch.msgid.link/20260903074329.6705-1-venkat88@linux.ibm.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
13 daysnet: dsa: microchip: enable the SGMII port of the KSZ9897STapio Reijonen
The KSZ9897 has an SGMII/1000BASE-X capable port 7, but its chip_info entry never set .sgmii_port. ksz_has_sgmii_port() is therefore false, ksz9477_pcs_create() is never called and ksz9477_phylink_mac_select_pcs() returns NULL for port 7, so a phy-mode = "sgmii" or "1000base-x" link on that port cannot come up. Only the KSZ9897S has that port; the KSZ9897R has a second RGMII port instead. Both report chip ID 0x00989700, so the port cannot be enabled from the chip ID alone, and enabling it unconditionally breaks the KSZ9897R badly: ksz9477_setup() propagates the failure of xpcs_create_pcs_mdiodev() on a part without an XPCS, so the switch as a whole stops probing. The variants do differ in the read-only bit 7 of the port 7 XMII control 0 register, which reads one on the KSZ9897S and zero on the KSZ9897R. Compare the KSZ9897S data sheet DS00002394C section 5.2.4.1 with the KSZ9897R data sheet DS00002330D section 5.2.3.1. Read that bit in ksz_switch_register() and use it to select a KSZ9897S chip_data entry, which is the KSZ9897 one plus .sgmii_port = 7, with port 7 no longer marked as supporting MII, RMII and RGMII. On the KSZ9897S that port is permanently an SGMII port and only its differential pairs are brought out, so advertising the xMII modes on it would let phylink accept a mode the driver never programs: ksz_phylink_need_config() skips the XMII control registers for the SGMII port. The KSZ9477, which also has SGMII on port 7, is described the same way. See DS00002394C section 4.11. KSZ9897S_CHIP_ID selects that chip_data entry and nothing else. dev->chip_id keeps the KSZ9897 chip ID that both parts report, so no other chip ID comparison has to know about the variant, ksz_check_device_id() is unchanged, and a device tree naming the KSZ9897 keeps matching whichever part is fitted. No binding change is needed and existing device trees keep working. Tested on a KSZ9897S with a 1000BASE-LX fibre SFP on port 7: bit 7 of the port 7 XMII control 0 register reads one, the switch is identified as a KSZ9897S and the PCS is created. The port advertises 1000baseX/Full, clause 37 in-band autonegotiation completes against the link partner, and the link comes up at 1Gbps/full duplex and passes traffic. Suggested-by: Nicolai Buchwitz <nb@tipi-net.de> Suggested-by: Jerry Ray <Jerry.Ray@microchip.com> Suggested-by: Tristram Ha <Tristram.Ha@microchip.com> Signed-off-by: Tapio Reijonen <tapio.reijonen@vaisala.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260904-ksz9897-sgmii-port-v5-1-9bd4a0381aa8@vaisala.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysvxlan: initialize _md in vxlan_xmit_one()Eric Dumazet
If a VXLAN device is configured with both VXLAN_F_COLLECT_METADATA and VXLAN_F_GBP, and a packet is transmitted through it using an external ip_tunnel_info that lacks the IP_TUNNEL_VXLAN_OPT_BIT flag, md is left pointing to the uninitialized _md stack variable: if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags)) { if (info->options_len < sizeof(*md)) goto drop; md = ip_tunnel_info_opts(info); } Because IP_TUNNEL_VXLAN_OPT_BIT is not set, md is not updated and remains pointing to _md. Later, vxlan_build_skb() is called with md, which eventually calls vxlan_build_gbp_hdr(): if (vxflags & VXLAN_F_GBP) vxlan_build_gbp_hdr(vxh, md); Inside vxlan_build_gbp_hdr(), md->gbp is read: if (!md->gbp) return; gbp = (struct vxlanhdr_gbp *)vxh; ... if (md->gbp & VXLAN_GBP_DONT_LEARN) gbp->dont_learn = 1; If the stack contains garbage, this causes: 1) VXLAN_HF_GBP flag to be spuriously set in the VXLAN header. 2) gbp->dont_learn and gbp->policy_applied to be set from stack bits. 3) gbp->policy_id to receive 16 bits of uninitialized kernel stack data, leaking it onto the wire. Fix this by zero-initializing _md. If IP_TUNNEL_VXLAN_OPT_BIT is not present, md->gbp remains 0, and vxlan_build_gbp_hdr() returns early without modifying the VXLAN header. Fixes: ee122c79d422 ("vxlan: Flow based tunneling") Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260906180111.1973188-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysscsi: qla2xxx: Fix the ql2xfc2target parameter descriptionKarl Mehltretter
The module parameter is ql2xfc2target, but its MODULE_PARM_DESC() names qla2xfc2target, so modinfo describes a parameter that does not exist and shows no description for the real one. Use the parameter name in the description. Fixes: 877b03795fcf ("scsi: qla2xxx: Add option to disable FC2 Target support") Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260906171009.2560-1-kmehltretter@gmail.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
13 daysdocs: networking: page_pool: Use page_pool_put_netmem_bulk() in the ↵Karl Mehltretter
kernel-doc directive page_pool.rst asks net/core/page_pool.c for page_pool_put_page_bulk(). Commit 024bfd2e9d80 ("page_pool: make page_pool_put_page_bulk() handle array of netmems") renamed the function to page_pool_put_netmem_bulk(). Since then the directive finds nothing and the bulk release helper is missing from the rendered page. Use the current name. Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260905084711.40105-1-kmehltretter@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysscsi: pm80xx: Fix the use_msix, use_tasklet and read_wwn parameter descriptionsKarl Mehltretter
The MODULE_PARM_DESC() lines of use_msix, use_tasklet and read_wwn all name a parameter zoned, which does not exist, and the use_tasklet one repeats the use_msix text. modinfo shows three "zoned" entries and no description for the real parameters. Name the right parameters and describe use_tasklet. Fixes: efa1fca45082 ("scsi: pm8001: Remove PM8001_USE_MSIX") Fixes: 205430290ad0 ("scsi: pm8001: Remove PM8001_USE_TASKLET") Fixes: 80975adc79dd ("scsi: pm8001: Remove PM8001_READ_VPD") Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/20260906170925.2524-1-kmehltretter@gmail.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
13 daysocteontx2-pf: reset HTB scheduler topology before freeing queuesRatheesh Kannoth
HTB offload programs NIX_AF_TLxX_TOPOLOGY on QoS-allocated scheduler queues via otx2_qos_txschq_set_parent_topology(), but teardown freed those queues without clearing TOPOLOGY. The AF only restores PARENT and SCHEDULE on free, so PRIO_ANCHOR/RR_PRIO settings can survive in the shared scheduler pool and affect later allocations. Add otx2_qos_reset_schq_topology() and otx2_qos_free_hw_schq() to zero TL4 through TL2 TOPOLOGY before each schq is returned to the AF during hierarchy teardown and cfg rollback. Skip the aggregation level (TL1): it is a per-tx-link queue shared by the PF, default Tx hierarchy and VFs, and is not freed back to the AF by nix_txschq_free_one(). Fixes: 5e6808b4c68d ("octeontx2-pf: Add support for HTB offload") Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260903020533.3068041-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 dayshwmon: (nct6694) do not expose enable on DTIN temperature channelsAli Ahmet Memis
The driver registers 26 temperature channels, all advertising HWMON_T_ENABLE, and indexes the enable bitmap with the raw channel: data->hwmon_en.tin_en[channel / 8] |= BIT(channel % 8); tin_en is two bytes and only covers the 5 THR and 5 TDP channels (index 0-9). The 16 DTIN channels (index 10-25) are enabled by the firmware and were never meant to carry an enable bit. Because the control structure is packed, writing temp17_enable and above indexes past tin_en into the fin_en bytes that follow it, so it toggles fan enable state instead; nct6694_hwmon_init() then sends the whole structure back to the device, and reads report fan state as temperature state. It stays within the structure, so this is not a memory safety problem, but on a board that uses the fan channels it is not harmless. Give the DTIN channels a temperature config without HWMON_T_ENABLE so the core never creates their enable attribute. The enable path is then reachable only for the first 10 channels, which stay within tin_en, and fin_en is left alone. The DTIN input and limit attributes are unchanged. Fixes: 197e779d29d8 ("hwmon: Add Nuvoton NCT6694 HWMON support") Suggested-by: Ming Yu <tmyu0@nuvoton.com> Link: https://lore.kernel.org/all/20260802124730.20387-1-ali@iusegentoo.com/ Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com> Link: https://patch.msgid.link/20260803102148.14196-1-ali@iusegentoo.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
13 dayshwmon: (asus_rog_ryujin) Synchronize HID command and report handlingArie Miller
rog_ryujin_execute_cmd() holds status_report_request_lock while reinitializing a completion, intending to exclude raw-event handling. However, rog_ryujin_raw_event() does not acquire the lock when it updates the completion. A response can therefore race with reinit_completion() and be lost, leaving the command to time out. Hold the lock while parsing reports and updating their completions. Use the irqsave variants in both paths because raw-event handling may run in interrupt context. Fixes: ed3e03790c5c ("hwmon: Add driver for ASUS ROG RYUJIN II 360 AIO cooler") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/linux-hwmon/20260812104617.858D01F000E9@smtp.kernel.org/ Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6-sol sparse Signed-off-by: Arie Miller <renari@arimil.com> Link: https://patch.msgid.link/20260904022129.97896-3-renari@arimil.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
13 dayshwmon: (asus_rog_ryujin) Validate HID report lengthsArie Miller
rog_ryujin_raw_event() parses response headers and payload fields without first checking that they are present in the received report. A short report can therefore make the driver consume uninitialized bytes from the HID transport buffer and expose them as sensor values through sysfs. Validate the response header and the fields used by each response type before parsing them. Fixes: ed3e03790c5c ("hwmon: Add driver for ASUS ROG RYUJIN II 360 AIO cooler") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/linux-hwmon/20260812104617.858D01F000E9@smtp.kernel.org/ Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6-sol sparse Signed-off-by: Arie Miller <renari@arimil.com> Link: https://patch.msgid.link/20260904022129.97896-2-renari@arimil.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
13 dayshwmon: (corsair-cpro) Remove debugfs entries when probe failsLinmao Li
ccp_debugfs_init() registers debugfs files whose private data is the devm allocated ccp. If hwmon_device_register_with_info() fails right after it, ccp_probe() returns without removing them: the HID core then frees ccp, and ccp_remove() is not called for a failed probe, so the files stay behind. Reading one of them dereferences the freed pointer. Remove the debugfs entries on that error path. debugfs_remove_recursive() waits for readers already inside the show callbacks, so ccp is no longer reachable through debugfs by the time probe returns. Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/linux-hwmon/20260708031612.BD7E61F000E9@smtp.kernel.org/ Fixes: 5997eb60f896 ("hwmon: (corsair-cpro) Add firmware and bootloader information") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Link: https://patch.msgid.link/20260828061949.3151191-1-lilinmao@kylinos.cn Signed-off-by: Guenter Roeck <linux@roeck-us.net>
13 dayshwmon: (aspeed-pwm-tacho) Propagate reset deassert errorsPengpeng Hou
aspeed_pwm_tacho_probe() installs its reset cleanup action and configures the controller after an unchecked reset deassertion. Stop probing when the reset controller rejects the transition, before the hwmon device becomes visible. Fixes: 18c514cc0e02 ("hwmon: (aspeed-pwm-tacho) Deassert reset in probe") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260830125044.97718-1-pengpeng@iscas.ac.cn Signed-off-by: Guenter Roeck <linux@roeck-us.net>
13 dayshwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()Cong Nguyen
set_fan_speed() writes the control GPIOs one bit at a time. Every other caller locks around it; gpio_fan_shutdown() doesn't. If it races a locked caller, the GPIO writes can interleave and leave the fan at a speed neither caller asked for. Fixes: b95579cd8795 ("hwmon: (gpio-fan) Add a shutdown handler to poweroff the fans") Reported-by: Sashiko AI review <sashiko-bot@kernel.org> Link: https://lore.kernel.org/r/20260830152150.27F5F1F000E9@smtp.kernel.org Assisted-by: Claude:claude-opus-4 Signed-off-by: Cong Nguyen <congnt264@gmail.com> Link: https://patch.msgid.link/20260901155404.1532092-1-congnt264@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
13 dayshwmon: (corsair-cpro) Create debugfs entries after hwmon registrationLinmao Li
ccp_debugfs_init() registers debugfs files whose private data is the devm allocated ccp. It runs before hwmon_device_register_with_info(), so when that registration fails, ccp_probe() returns with the files still in place. The HID core then frees ccp, and ccp_remove() is not called for a failed probe, so nothing removes them later either. Reading one of the files dereferences the freed pointer. Create the debugfs entries only after the hwmon device has been registered, so no failing path can leave them behind. The two version queries stay where they are. They send USB commands without holding ccp->mutex, which is only safe as long as nothing else can call send_usb_cmd(); once the hwmon device is registered its callbacks can do so concurrently. Only the debugfs creation moves, and it is told which queries succeeded. Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/linux-hwmon/20260708031612.BD7E61F000E9@smtp.kernel.org/ Suggested-by: Guenter Roeck <linux@roeck-us.net> Fixes: 5997eb60f896 ("hwmon: (corsair-cpro) Add firmware and bootloader information") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Link: https://patch.msgid.link/20260831014509.3352442-1-lilinmao@kylinos.cn Signed-off-by: Guenter Roeck <linux@roeck-us.net>
13 dayshwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTSVishnu Razdan
Some hwmon alarms fall back to STATUS_WORD summary bits when no individual limit alarm is available. On PMBus 1.2 and newer devices, pmbus_get_boolean() acknowledges these alarms with the same byte-data write used for detailed status registers. For example, PB_STATUS_INPUT is 0x2000, so it is truncated to zero when passed to _pmbus_write_byte_data(). The resulting write cannot acknowledge the input alarm. PMBus 1.3 Part II, sections 10.2.4 and 10.2.5, excludes ordinary STATUS_BYTE and STATUS_WORD summary bits from individual clearing. Their summary bits clear when the underlying status bits clear, so changing this to a word-data write would not fix the generic input alarm either. Use the existing page CLEAR_FAULTS path for generic STATUS_WORD alarms, including devices whose status accessor uses STATUS_BYTE. Keep individual byte writes for detailed status registers on PMBus 1.2 and newer devices. As with the existing older-device fallback, CLEAR_FAULTS can clear other latched status; an active condition can reassert its status. Fixes: 35f165f08950 ("hwmon: (pmbus) Clear pmbus fault/warning bits after read") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Vishnu Razdan <vrazdan@openai.com> Link: https://patch.msgid.link/20260824-vrazdan-pmbus-status-word-b4-v1-1-2606ecd0c029@openai.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
13 dayshwmon: (chipcap2) fix channels in humidity alarm notificationsJavier Carrasco
hwmon_notify_event() expects the channel number as its last argument, taken into account with the type parameter that it is a humidity sensor type. Given that this device only provides one humidity channel, 0 must be passed. The custom construct to enumerate the channels makes wrong assumptions by listing all types together (temperature and humidity). Remove the custom channel enumeration and pass the right channel to hwmon_notify_event() for hwmon_humidity_min_alarm and hwmon_humidity_max_alarm. Fixes: 3af350929e75 ("hwmon: Add support for Amphenol ChipCap 2") Cc: stable@vger.kernel.org Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com> Link: https://patch.msgid.link/20260823-chipcap2_locks-v2-1-6a26c8e9e2fc@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
13 daysMerge branch 'netconsole-validate-a-target-s-ip-address-configuration'Jakub Kicinski
Gustavo Luiz Duarte says: ==================== netconsole: validate a target's IP address configuration This series adds two validations to the target configuration when the user tries to enable it: first whether remote_ip was set, and second whether local_ip and remote_ip address families match. Refuse to enable the target if any of those validations fail. These validations are already done for the target passed on the command-line, so this aligns dynamic targets with the command-line behavior. The first two patches replace the per-target 'ipv6' flag with a per-address 'family' field, which makes it easier to detect these error conditions. Patches 3 and 4 implement the actual validations. Patches 5-7 are follow-ups from previous reviews: move inet_addr from netpoll.h into netconsole.c, show an unset address as an empty string rather than "0.0.0.0", document local_ip auto-selection. ==================== Link: https://patch.msgid.link/20260903-netcons_ipv6-v4-0-bdd183c844d3@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysdocs: netconsole: document local_ip auto-selectionGustavo Luiz Duarte
An unset local_ip is auto-populated from the egress interface at enable time, but any value the user writes, including 0.0.0.0, is used as-is. This deviates from the behavior prior to "netconsole: use the address family instead of the ipv6 flag", which interpreted 0.0.0.0 as unset. Document this so the distinction between "unset" and "set to 0.0.0.0" is clear. Reviewed-by: Breno Leitao <leitao@debian.org> Signed-off-by: Gustavo Luiz Duarte <gustavold@gmail.com> Link: https://patch.msgid.link/20260903-netcons_ipv6-v4-7-bdd183c844d3@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysnetconsole: move struct inet_addr into netconsole.cGustavo Luiz Duarte
The struct inet_addr lives in netpoll.h, but since commit a1116396476f ("netconsole: move local_ip/remote_ip/ipv6 to netconsole_target") the only user is netconsole. Move the definition into netconsole.c Suggested-by: Breno Leitao <leitao@debian.org> Reviewed-by: Breno Leitao <leitao@debian.org> Signed-off-by: Gustavo Luiz Duarte <gustavold@gmail.com> Link: https://patch.msgid.link/20260903-netcons_ipv6-v4-6-bdd183c844d3@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysnetconsole: show empty string for an unset IP addressGustavo Luiz Duarte
An unset address (local_ip/remote_ip), now denoted by AF_UNSPEC, currently shows "0.0.0.0" in configfs. Print an empty string instead, which is more clear. In netconsole_print_banner() we can be even more explicit about it, as we don't have the risk of userspace trying to parse it. Reviewed-by: Breno Leitao <leitao@debian.org> Signed-off-by: Gustavo Luiz Duarte <gustavold@gmail.com> Link: https://patch.msgid.link/20260903-netcons_ipv6-v4-5-bdd183c844d3@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysnetconsole: reject a target mixing IPv4 and IPv6 addressesGustavo Luiz Duarte
The local_ip and remote_ip configfs attributes are written independently and nothing stops a user from mixing ipv4 and ipv6. This leads to an ipv4 address being zero-extended into an ipv6 header or an ipv6 address being truncated to its first 4 bytes for an ipv4 header. The command-line parser already refuses such a mismatch. This adds a similar check when a dynamic target is being enabled. Reviewed-by: Breno Leitao <leitao@debian.org> Signed-off-by: Gustavo Luiz Duarte <gustavold@gmail.com> Link: https://patch.msgid.link/20260903-netcons_ipv6-v4-4-bdd183c844d3@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysnetconsole: reject enabling a target with no remote IP addressGustavo Luiz Duarte
The command-line path already requires a remote address, but if a user creates a dynamic target and enables it without setting a remote address, we currently try sending netconsole traffic to "0.0.0.0". Refuse to enable a target if the remote address is unset. Reviewed-by: Breno Leitao <leitao@debian.org> Signed-off-by: Gustavo Luiz Duarte <gustavold@gmail.com> Link: https://patch.msgid.link/20260903-netcons_ipv6-v4-3-bdd183c844d3@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysnetconsole: use the address family instead of the ipv6 flagGustavo Luiz Duarte
Now that we have the address family in inet_addr, use that and remove nt->ipv6. We no longer need netcons_local_ip_unset() to check that all bytes are zeroes, as that is now denoted by (family == AF_UNSPEC). Reviewed-by: Breno Leitao <leitao@debian.org> Signed-off-by: Gustavo Luiz Duarte <gustavold@gmail.com> Link: https://patch.msgid.link/20260903-netcons_ipv6-v4-2-bdd183c844d3@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysnetconsole: add an address family to struct inet_addrGustavo Luiz Duarte
netconsole_target stores a single 'bool ipv6' to denote the target's address family. This makes it hard to detect conditions like "no address set" or ipv4/ipv6 mixup between local_ip and remote_ip. Add a 'family' field to inet_addr so each address stores its own address family: AF_UNSPEC while unset, else AF_INET or AF_INET6. Nothing reads the new field yet. The next patch switches the users over and removes the bool. No functional change. Reviewed-by: Breno Leitao <leitao@debian.org> Signed-off-by: Gustavo Luiz Duarte <gustavold@gmail.com> Link: https://patch.msgid.link/20260903-netcons_ipv6-v4-1-bdd183c844d3@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 dayssmb: client: fix one-byte OOB read in smb2_parse_native_symlink()Paulo Alcantara
When parsing a share-root relative native symlink, memcpy copies smb_target+1 (skipping the leading separator) but uses strlen(smb_target)+1 as the length, reading one byte past the allocated buffer. This fixes the following KASAN splat when accessing an SMB symlink with a target of '\a\b': BUG: KASAN: slab-out-of-bounds in smb2_parse_native_symlink+0x4f5/0xca0 Read of size 5 at addr ffff88800878fe21 by task netfsfuzz-execu/1 CPU: 1 UID: 0 PID: 1 Comm: netfsfuzz-execu Tainted: G N 7.2.0-11943-g2709dd5ae32f-dirty #1 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996) Call Trace: <TASK> dump_stack_lvl+0x7b/0xa0 print_report+0xd0/0x630 kasan_report+0xe5/0x120 kasan_check_range+0x105/0x1b0 __asan_memcpy+0x23/0x60 smb2_parse_native_symlink+0x4f5/0xca0 parse_reparse_point+0x68a/0x1530 reparse_info_to_fattr+0x752/0xa20 cifs_get_fattr+0x873/0x15b0 cifs_get_inode_info+0xc0/0x310 cifs_lookup+0x308/0xa70 __lookup_slow+0x122/0x2b0 lookup_slow+0x50/0x70 path_lookupat+0x525/0xaf0 filename_lookup+0x1f2/0x550 vfs_statx+0xd1/0x1a0 vfs_fstatat+0x65/0xc0 __do_sys_newfstatat+0x9a/0x120 do_syscall_64+0xdd/0x4a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Reported-by: Yuanfu Xie <yuanfuxie@stu.pku.edu.cn> Fixes: 723f4ef90452 ("cifs: Fix parsing native symlinks relative to the export") Suggested-by: Pali Rohar <pali@kernel.org> Reviewed-by: Pali Rohar <pali@kernel.org> Reviewed-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org> Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com> Cc: Shyam Prasad N <sprasad@microsoft.com> Cc: Tom Talpey <tom@talpey.com> Cc: Bharath SM <bharathsm@microsoft.com> Cc: stable@vger.kernel.org
13 daysnet: ks8851: Fix receiver error in 100BASE-TX mode following software power-downMarek Vasut
KSZ8851 errata sheet DS80000716D-page 4 Module 3 [1] states that, when issuing a software power-down (PMECR[1:0] = 10) followed by a power-on (PMECR[1:0] = 00), the receiver circuit can fail to start properly preventing communication. The Transmitter will still send data, but no data will be received. The errata sheet also includes a workaround, which states that, it is recommended that the software power-down feature not be used. Implement that workaround and drop the entry into software power-down mode. The ks8851_write_mac_addr() calls entry into normal power-on mode at the very beginning of the function, therefore dropping the second call to enter software power-down mode is sufficient here. The ks8851_net_stop() can only be called after ks8851_net_start() was already called, and ks8851_net_start() also makes the MAC enter normal power-on mode, therefore it is also fine to drop the call to enter software power-down mode from ks8851_net_stop(). This will lead to a slight increase in power consumption, but it also fixes a sporadic reliability problem on at least KSZ8851-16MLL, which is where the problem was reported and this fix was tested. [1] https://ww1.microchip.com/downloads/en/DeviceDoc/80000716D.pdf Fixes: 3ba81f3ece3c ("net: Micrel KS8851 SPI network driver") Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Marek Vasut <marex@nabladev.com> Link: https://patch.msgid.link/20260905130327.203851-1-marex@nabladev.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysdocs: mctp: Fix the struct mctp_sk_key nameKarl Mehltretter
struct sk_key does not exist; the type is struct mctp_sk_key. Use it. Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260905095150.42180-1-kmehltretter@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysdocs: mctp: Fix the struct net_device nameKarl Mehltretter
struct netdevice does not exist; the type is struct net_device. Use it. Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260905095116.42147-1-kmehltretter@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysnet: dsa: lantiq_gswip: fix GSWIP_MDIO_PHY_FCONTX_EN valueJan Havran (Advantech Czech)
Per the GSW145 data sheet, the FCONTX (bits 8:7) and FCONRX (bits 6:5) flow-control fields of the PHY_ADDR_n register both encode 00 = AUTO, 01 = EN, 10 = reserved, 11 = DIS. GSWIP_MDIO_PHY_FCONTX_EN was 0x0100, i.e. field value 10 (the reserved encoding), instead of 0x0080 (01 = EN); FCONRX_EN is already 0x0020 (01). Enabling tx flow control therefore wrote the reserved value. Set FCONTX_EN to 0x0080. The register is shared by all supported parts. Fixes: 14fceff4771e ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") Signed-off-by: Jan Havran (Advantech Czech) <havran.jan@email.cz> Reviewed-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260907134818.16670-4-havran.jan@email.cz Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysMerge branch 'net-dsa-lantiq_gswip-sgmii-2500base-x-and-flow-control-fixes'Jakub Kicinski
Jan Havran says: ==================== net: dsa: lantiq_gswip: SGMII/2500BASE-X and flow-control fixes This series fixes three issues in the lantiq_gswip / mxl-gsw1xx DSA driver found while bringing up a MaxLinear GSW145 over SGMII on a Marvell Armada 7040 board, with the switch CPU port running 2500BASE-X and the user ports at 1000BASE-T. Patch 1 reorders the SerDes NCO clock-rate setup ahead of the SGMII shell reset. Without it, only the rate the switch was left at by the straps or the boot loader links up; the other rate comes up but forwards no traffic. Patch 2 adds the missing SPEED_2500 case to gswip_port_set_speed(); without it the CPU port was forced to 10 Mbps at 2.5G link-up. Tested on GSW145 hardware only. The register values are backed by the public GSW145 data sheet and by the driver's own field encoding; the xRX200/xRX300 data sheets are not public. ==================== Link: https://patch.msgid.link/20260907134818.16670-1-havran.jan@email.cz Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysnet: dsa: lantiq_gswip: handle SPEED_2500 in gswip_port_set_speed()Jan Havran (Advantech Czech)
The mxl-gsw1xx driver advertises 2500BASE-X on its SGMII port (via supports_2500m and gsw1xx_phylink_get_caps()), but the shared gswip_port_set_speed() has no SPEED_2500 case: at 2.5G every field keeps its initializer, so mdio_phy = 0 pins the MDIO speed override to 10 Mbps and no data passes. At the MAC/MDIO level 2500BASE-X is identical to 1 Gbps (same wide GMII datapath, same speed override); the rate itself is set in the PCS and SerDes, not here. This matches the boot loader's PHY_ADDR_4 = 0x32A4 for the 2.5G strap ("1 Gbps or above"), whose SPEED field is GSWIP_MDIO_PHY_SPEED_G1 (the field has no encoding above G1). Share the SPEED_1000 arm via a stacked case label. Its mii_cfg value is a no-op for 2.5G: gswip_mii_mask_cfg() writes it only for the RGMII port (mii_cfg[SGMII port] == -1), which cannot reach 2.5G anyway. Cc: stable+noautosel@kernel.org # never worked Signed-off-by: Jan Havran (Advantech Czech) <havran.jan@email.cz> Reviewed-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260907134818.16670-3-havran.jan@email.cz Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysnet: dsa: mxl-gsw1xx: set SerDes NCO rate before SGMII resetJan Havran (Advantech Czech)
gsw1xx_pcs_config() releases the SGMII shell from reset via gsw1xx_pcs_reset() and only afterwards programs NCO_CTRL to select the SerDes clock rate (1G NCO1 vs 2.5G NCO2). The chip boot loader uses the other order: NCO_CTRL -> RST_REQ -> SGMII_PHY_HWBU_CTRL (GSW145 data sheet, section 3.2.8, table 13). Program NCO_CTRL before gsw1xx_pcs_reset() to follow that order. On an Armada 7040 board driving a GSW145 whose switch comes up at 2.5G (pin strap PS_SUBTYPE_MD[2] = 1, pin LED42 / PS1 bit 14; GSW145 data sheet tables 23 and 25), a 1 Gbps SGMII link only carried traffic with this change. It matters when the rate the switch is left at - by the straps or by the boot loader - differs from the rate the driver selects, which is likely why it has not been seen before. Cc: stable+noautosel@kernel.org # never worked Signed-off-by: Jan Havran (Advantech Czech) <havran.jan@email.cz> Reviewed-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260907134818.16670-2-havran.jan@email.cz Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysnet: dsa: motorcomm: Handle degenerated blink delaysDavid Yang
The LED core defines delay_on == 0 as steady off and delay_off == 0 as steady on, which was treated as a blink in our LED driver. Fix it. Fixes: 9af9a8168213 ("net: dsa: motorcomm: Add LED support") Signed-off-by: David Yang <mmyangfl@gmail.com> Link: https://patch.msgid.link/20260904134752.635133-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysMerge branch 'intel-fix-typos-in-comments'Jakub Kicinski
Hemanth Selam says: ==================== intel: fix typos in comments Comment typos across the Intel ethernet drivers, split per driver. Found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Comments only, no code changes. v1: https://lore.kernel.org/20260907064528.6602-1-hemanth.selam@gmail.com ==================== Link: https://patch.msgid.link/20260907095446.27290-1-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysDocumentation/eth/intel: fix repeated words in commentsHemanth Selam
Drop repeated words reported by checkpatch.pl. Only touches documentation text. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260907095446.27290-5-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysixgbevf: fix typo "enble" in commentHemanth Selam
Fix a typo in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260907095446.27290-4-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysice: fix typos in commentsHemanth Selam
Fix typos in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260907095446.27290-3-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysi40e: fix typos in commentsHemanth Selam
Fix typos in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260907095446.27290-2-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysselftests/net: skip srv6_end_dt[4/6]_l3vpn_test.sh if vrftable not availableAlessio Faina
In case iproute2 is older than version 5.11.0, released ~Feb 23, 2021, the vrftable support is not available and the tests contained in the following 2 test files - srv6_end_dt4_l3vpn_test.sh - srv6_end_dt6_l3vpn_test.sh are failing in some kernel backports. This is the result of one of those tests in an unsupported environment: ########################################################################## TEST SECTION: SRv6 VPN connectivity test among hosts in the same tenant ########################################################################## TEST: Hosts connectivity: hs-t100-1 -> hs-t100-2 (tenant 100) [FAIL] TEST: Hosts connectivity: hs-t100-2 -> hs-t100-1 (tenant 100) [FAIL] TEST: Hosts connectivity: hs-t200-3 -> hs-t200-4 (tenant 200) [FAIL] TEST: Hosts connectivity: hs-t200-4 -> hs-t200-3 (tenant 200) [FAIL] The test installs a route with the vrftable feature; if this feature is not available, the approach taken is to skip the test rather than failing it. Signed-off-by: Alessio Faina <alessio.faina@canonical.com> Reviewed-by: Andrea Mayer <andrea.mayer@uniroma2.it> Link: https://patch.msgid.link/20260907100631.1923148-1-alessio.faina@canonical.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 daysinet: frags: invalidate queues before flushing themYilin Zhang
fqdir_pre_exit() flushes the skbs from incomplete queues without changing their completion state. A fragment which found a queue before high_thresh was cleared can then acquire the queue lock and reuse stale reassembly metadata. A queue concurrently killed after fqdir->dead is set can instead become INET_FRAG_COMPLETE|INET_FRAG_HASH_DEAD while still holding its old skbs; skipping it because it is complete leaves those references behind until asynchronous fqdir teardown. For IPv6, stale metadata can make ip6_frag_reasm() use the old nhoffset with a new skb and access memory out of bounds. The resulting heap corruption can be leveraged for local privilege escalation when unprivileged network namespaces are available. Unflushed fragments can also keep conntrack references alive after the conntrack per-net cleanup point. Kill each incomplete queue, then flush every queue still owned by the dying rhashtable. HASH_DEAD identifies that ownership, while complete queues without it are already owned by another destroy path and must be left alone. Releasing a timer reference removed by inet_frag_kill() is deferred to inet_frag_putn(), after the queue lock is dropped. KASAN report: BUG: KASAN: slab-out-of-bounds in ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2)) Write of size 1 at addr ff110001039c6e00 by task poc/771 Call Trace: ? ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2)) ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2)) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479 (discriminator 5)) ip6_input_finish (net/ipv6/ip6_input.c:534) ipv6_rcv (include/net/dst.h:480 (discriminator 3) net/ipv6/ip6_input.c:119 (discriminator 3) net/ipv6/ip6_input.c:109 (discriminator 3) include/linux/netfilter.h:325 (discriminator 3) include/linux/netfilter.h:319 (discriminator 3) net/ipv6/ip6_input.c:351 (discriminator 3)) packet_sendmsg (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142) __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880) The buggy address belongs to the object at ff110001039c6b40 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 0 bytes to the right of allocated 704-byte region [ff110001039c6b40, ff110001039c6e00) BUG: KASAN: slab-out-of-bounds in ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1)) Read of size 1 at addr ff110001039c6e08 by task poc/771 Call Trace: ? ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1)) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1)) ip6_input_finish (net/ipv6/ip6_input.c:534) ipv6_rcv (include/net/dst.h:480 (discriminator 3) net/ipv6/ip6_input.c:119 (discriminator 3) net/ipv6/ip6_input.c:109 (discriminator 3) include/linux/netfilter.h:325 (discriminator 3) include/linux/netfilter.h:319 (discriminator 3) net/ipv6/ip6_input.c:351 (discriminator 3)) packet_sendmsg (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142) __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880) packet_sendmsg (net/packet/af_packet.c:2959 net/packet/af_packet.c:3053 net/packet/af_packet.c:3142) __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880) The buggy address belongs to the object at ff110001039c6b40 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 8 bytes to the right of allocated 704-byte region [ff110001039c6b40, ff110001039c6e00) Fixes: 006a5035b495 ("inet: frags: flush pending skbs in fqdir_pre_exit()") Cc: stable@vger.kernel.org Reported-by: Kimi Security Team <bug-report@moonshot.ai> Tested-by: Weiming Shi <shiweiming@moonshot.ai> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Yilin Zhang <yilinzhang@moonshot.ai> Link: https://patch.msgid.link/20260904162800.1095662-1-yilinzhang@moonshot.ai Signed-off-by: Jakub Kicinski <kuba@kernel.org>
13 dayspower: supply: ds2780: Fix ds2780_get_capacity() returning raw valueXueqin Luo
ds2780_get_capacity() returns the raw register value instead of 0 on success. The capacity is already stored in *capacity, so the function should return 0 to indicate success. Fixes: 275ac74629c4 ("w1: add Maxim/Dallas DS2780 Stand-Alone Fuel Gauge IC support") Signed-off-by: Xueqin Luo <luoxueqin@kylinos.cn> Link: https://patch.msgid.link/20260901072954.1953121-1-luoxueqin@kylinos.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
13 dayspower: supply: cros_charge-control: adopt EC charge state on probeMatt DeVillier
The driver previously always forced AUTO with no charge limits at probe, which discarded sustainer thresholds and modes set by firmware or firmware setup before the kernel loaded. For command versions that support GET (v2+), read the EC state into the driver cache instead. Valid sustainer limits are adopted as AUTO with those thresholds: while the sustainer is active the EC may report IDLE or DISCHARGE as a transient hold/discharge step, which must not be exposed as inhibit-charge or force-discharge. Sustainer off (-1/-1) still maps to Linux "no limit" (0/100); other invalid limit pairs are remapped the same way with a warning and pushed back to the EC so the cache stays in sync. If GET fails, fall back to the previous defaults and SET them on the EC. Command version 1 still cannot report state and keeps forcing a well-known configuration. Signed-off-by: Matt DeVillier <matt.devillier@gmail.com> Acked-by: Thomas Weißschuh <linux@weissschuh.net> Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org> Link: https://patch.msgid.link/20260825120929.13168-2-matt.devillier@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
13 dayspower: supply: bq2515x: Propagate charge-enable read errorsLinmao Li
bq2515x_get_charge_disable() returns bool even though reading the charger-disable state can fail. A negative error is therefore converted to true, so POWER_SUPPLY_PROP_STATUS reports NOT_CHARGING with success instead of propagating the failure. The GPIO read is not checked for errors either. Return an int from the helper, check both reads, and only convert a valid charger-disable state to the charging-status boolean. Fixes: 44908459275e ("power: supply: bq25150 introduce the bq25150") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Link: https://patch.msgid.link/20260824084217.670213-1-lilinmao@kylinos.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
13 dayspower: supply: bq27xxx: add support for bq27z746Henrik Grimler
bq27z746 is similar to bq27z561, but has additional battery protection logic. The standard register map is a subset of the one found in bq27z561. There are some more differences among the ManufacturerAccess registers, but the ManufacturerAccess registers are currently not handled by the driver in any way. Therefore use the same regs and props for bq27z746 and bq27z561. Signed-off-by: Henrik Grimler <henrik.grimler@axis.com> Acked-by: Andrew Davis <afd@ti.com> Link: https://patch.msgid.link/20260818-bq27z746-v2-3-0371e206665f@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
13 daysdt-bindings: power: bq27xxx: document bq27z746Henrik Grimler
Add compatible for Texas Instruments bq27z746 fuel gauge, which is similar to its sibling bq27z561. Unlike bq27z561, bq27z746 includes some protection logic and can drive external MOSFETs. The register map is a subset of the one found in bq27z561, with bq27z561 having six extra registers at the end at 0x70 - 0x7A. Among the ManufacturerAccess registers there are some more differences mainly related to MOSFET control and deep sleep/shipping mode. Signed-off-by: Henrik Grimler <henrik.grimler@axis.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260818-bq27z746-v2-2-0371e206665f@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
13 daysdt-bindings: power: bq27xxx: bq27z561: allow interrupts propertyHenrik Grimler
According to the technical reference manual for bq27z561 it has support for an interrupt on an INT pin. Remove it from the list of devices without interrupt support to better describe the hardware. Fixes: b4f7a727c29c ("dt-bindings: power: supply: bq27xxx: document optional interrupt") Signed-off-by: Henrik Grimler <henrik.grimler@axis.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260818-bq27z746-v2-1-0371e206665f@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
13 dayspower: supply: bq25630: Add support for BATFET controlWaqar Hameed
The framework supports controlling system load with `POWER_SUPPLY_PROP_LOAD_SWITCH`. Use this to select between the different supported BATFET control modes. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/f9d62a7fbabb1a920b31f79438cc737df78d0140.1788290289.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
13 dayspower: supply: bq24190: Use POWER_SUPPLY_PROP_LOAD_SWITCHWaqar Hameed
The `online`-property has historically been (ab)used for controlling the BATFET in this driver. The framework supports controlling system load with `POWER_SUPPLY_PROP_LOAD_SWITCH`. Use this to control the BATFET, but keep the support for `online` in order to have ABI backward compatibility. Moreover, don't bother with converting the `online`-functions to use the new `charger_get/set_batfet_ctrl()` to keep the code more readable. It's already quite messy, e.g. `charge_set_online()` calls `battery_set_online()`. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/44792a20fb581cfd3587fd71147f29e22c7f3749.1788290289.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
13 dayspower: supply: bq24257: Use POWER_SUPPLY_PROP_LOAD_SWITCHWaqar Hameed
The framework supports controlling system load with `POWER_SUPPLY_PROP_LOAD_SWITCH`. Use this to control `SYSOFF`, but keep old custom `sysfs` ABI for backward compatibility. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/d5b2615e549725a9294f9dd51787692591743cce.1788290289.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>