summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-07-23usb: gadget: f_mass_storage: Remove obsolete version logFabio Estevam
The mass-storage function prints the following message whenever a function instance is allocated: Mass Storage Function, version: 2009/09/11 The hard-coded date does not identify the running kernel or provide useful diagnostic information. Remove the message and the unused version definition. Signed-off-by: Fabio Estevam <festevam@gmail.com> Link: https://patch.msgid.link/20260721020957.81956-1-festevam@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-23usb: typec: tcpm: implement retry mechanism for Discover Identity VDMsRD Babiera
The current mechanism for sending Discover Identity in the ready state presents a flaw where tcpm_queue_vdm can collide with non interruptible AMSes such as GET_SINK_CAP or VCONN_SWAP. vdm_run_state_machine will hit the VDM_STATE_BUSY state, and Discover SVIDs or Discover Modes will not retry. This patch introduces a state machine under the enum vdm_discovery_states. The tcpm_port field vdm_discovery_state tracks which step of the Discover Identity process has been completed. The current TCPM implementation utilizes the send_discover and send_discover_prime booleans to queue Discover Identity in the aforementioned collision case. These booleans are removed in place of vdm_discovery_state and send_discover_work is replaced by vdm_discovery_work, which runs unconditionally in the ready state. When the Discovery process is complete, the port will move to the VDM_DISCOVERY_COMPLETE state and vdm_discovery_work becomes a no-op. When there are still Discovery VDMs to be sent, vdm_discovery_work will continue based on the last received response from the port partner or cable. Signed-off-by: RD Babiera <rdbabiera@google.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Reviewed-by: Badhri Jagan Sridharan <badhri@google.com> Link: https://patch.msgid.link/20260717232612.3671978-2-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-23drm/etnaviv: force flush on power register opsRandolph Sapp
Add gpu_write_power_sync to verify that power register modifications have reached the endpoint device in sequence specific sections that do not validate device state. These sequence specific areas have been detected experimentally with an am57xx-evm through numerous boot and module load+unload cycles. Signed-off-by: Randolph Sapp <rs@ti.com> Reviewed-by: Lucas Stach <l.stach@pengutronix.de> Signed-off-by: Lucas Stach <l.stach@pengutronix.de> Link: https://patch.msgid.link/20251013170122.1145387-2-rs@ti.com
2026-07-23RDMA/efa: Expose 64-bit send WR ID support to userspaceYonatan Nachum
Currently EFA WRs support 16-bit request ID, this requires EFA to manage a translation table to translate the IB WR ID from 64-bits to 16-bits and translating it back on CQ completion. Expose a new device capability to handle 64-bit request ID for SQ WRs allowing userspace to directly post the 64-bit ID to the device. Reviewed-by: Michael Margolin <mrgolin@amazon.com> Reviewed-by: Tom Sela <tomsela@amazon.com> Signed-off-by: Yonatan Nachum <ynachum@amazon.com> Link: https://patch.msgid.link/20260722113331.2515247-3-ynachum@amazon.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-23RDMA/efa: Add CQ/QP creation with 64-bit SQ req ID supportYonatan Nachum
Add the support needed to propagate the user requested flags to config the CQ/QP to support 64-bit SQ request ID to the device. Reviewed-by: Michael Margolin <mrgolin@amazon.com> Reviewed-by: Tom Sela <tomsela@amazon.com> Signed-off-by: Yonatan Nachum <ynachum@amazon.com> Link: https://patch.msgid.link/20260722113331.2515247-2-ynachum@amazon.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-23ata: pata_ep93xx: fix PIO fallback when DMA init failsRosen Penev
ep93xx_pata_dma_init() returns an error when dma_request_chan() fails, which causes ep93xx_pata_probe() to abort entirely. The probe function already has a PIO fallback path (it checks both channel pointers before enabling UDMA), so the DMA init should not fail the probe on non-fatal errors. Propagate -EPROBE_DEFER, such that we allow the DMA controller driver to load, in case we got probed before the DMA controller driver. For all other failures (e.g. -ENODEV when the DMA controller is missing in the device tree), fall back to PIO. Assisted-by: Opencode:Big-Pickle Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-23ata: pata_pxa: use devres for DMA channel managementRosen Penev
Convert the DMA channel request to devm_dma_request_chan() so the channel is released automatically on device teardown. This removes the explicit dma_release_channel() calls in the probe error paths and in pxa_ata_remove(), simplifying the driver. Use ata_platform_remove_one() which is now equivalent to what remains of the remove function after dma_release_channel() removal. Built as a module for arm/pxa_defconfig (CONFIG_PATA_PXA=m) with LLVM=1 W=1; no new warnings. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-23drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()Shuicheng Lin
Commit 9e9787414882 ("drm/xe/userptr: replace xe_hmm with gpusvm") made xe_svm_init() unconditional in xe_vm_create() and extended it to also initialize a "simple" gpusvm state for non-fault-mode VMs. The matching xe_svm_fini() call in xe_vm_close_and_put() was updated to run unconditionally, but the error unwind path in xe_vm_create() was not. On the drm_gpuvm_resv_object_alloc() failure path, xe_svm_init() has already succeeded but xe_svm_fini() is only called when XE_VM_FLAG_FAULT_MODE is set. For non-fault-mode VMs this leaves vm->svm.gpusvm partially initialized and leaks the resources allocated by drm_gpusvm_init(). For fault-mode VMs, xe_svm_init() additionally acquires the pagemap owner via drm_pagemap_acquire_owner() and the pagemaps via xe_svm_get_pagemaps(). Those resources are released by xe_svm_close(), not xe_svm_fini(). On the same error path, xe_svm_close() is not called either, so fault-mode VMs leak the pagemap owner and pagemaps. Fix both leaks: - Call xe_svm_fini() unconditionally on the err_svm_fini path, matching the unconditional xe_svm_init() call. Move the vm->size = 0 assignment out of the conditional so the xe_vm_is_closed() assert in xe_svm_fini() (and xe_svm_close()) holds for both modes. - Call xe_svm_close() for fault-mode VMs before xe_svm_fini(), matching the ordering used in xe_vm_close_and_put(). Fixes: 9e9787414882 ("drm/xe/userptr: replace xe_hmm with gpusvm") Cc: Matthew Auld <matthew.auld@intel.com> Assisted-by: Claude:claude-opus-4.7 Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260721205516.4058959-2-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com> (cherry picked from commit ca2a3587d577ba764e0fe628fb676244fc33ddd4) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-07-23drm/xe/i2c: Allow per domain unique idRaag Jadav
PCI bus, device and function can be same for devices existing across different domains. Allow per domain unique identifier while registering platform device to prevent name conflict. Fixes: f0e53aadd702 ("drm/xe: Support for I2C attached MCUs") Signed-off-by: Raag Jadav <raag.jadav@intel.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://patch.msgid.link/20260721113438.651100-1-raag.jadav@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> (cherry picked from commit a79f6abc8b516b5bd906e2eca8121e3549ee163f) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-07-23soc: xilinx: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Acked-by: Michal Simek <michal.simek@amd.com> Link: https://patch.msgid.link/20260722023523.42269-6-panchuang@vivo.com Signed-off-by: Michal Simek <michal.simek@amd.com>
2026-07-23efi: Make EFI_VARS_PSTORE depend on EFIVAR_FSTheodore Tucker
The efivars backend to pstore will not register if the efivarfs is not available. The efivars sysfs interface was removed in Linux 6.0, meaning efivarfs is now the only way pstore can write into EFI variables. Making the dependency on the efivarfs explicit removes a stumbling block when configuring a kernel with pstore. Signed-off-by: Theodore Tucker <theodore@tti0.net> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-07-23fpga: zynq-fpga: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Michal Simek <michal.simek@amd.com> Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/20260713132237.370272-1-panchuang@vivo.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
2026-07-23gpu: nova-core: wait for RISC-V HALTED on FSP unloadEliot Courtney
Currently the code waits for "not active" but this is not the same as halted as there are more than two states. Match openrm here and wait for halted instead. Fixes: c7fea1f70944 ("gpu: nova-core: add non-sec2 unload path") Signed-off-by: Eliot Courtney <ecourtney@nvidia.com> Link: https://patch.msgid.link/20260703-blackwell-fixes-v2-10-8e3d8bc32bb9@nvidia.com [acourbot: s/imply/guarantee.] Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-23cpufreq: apple-soc: Calculate frequency as a 64-bit valueSasha Finkelstein
The current frequency calculation is done in 32 bit, causing problems if run on a future SoC that can boost higher than 4.2GHz. Ideally, we should use a true u64 instead of unsigned long and "knowning" that this only runs on 64 bit machines, but the core code uses ulong everywhere, so this should be good enough. Signed-off-by: Sasha Finkelstein <k@chaosmail.tech> Reviewed-by: Joshua Peisach <jpeisach@ubuntu.com> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com> Reviewed-by: Janne Grunau <j@jannau.net> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-07-23gpu: nova-core: correct RISC-V HALTED fieldEliot Courtney
This uses the incorrect value, so update it. Fixes: bb58d1aee608 ("gpu: nova-core: falcon: Add support to check if RISC-V is active") Signed-off-by: Eliot Courtney <ecourtney@nvidia.com> Link: https://patch.msgid.link/20260703-blackwell-fixes-v2-9-8e3d8bc32bb9@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-23gpu: nova-core: gsp: ensure LibOS DMA allocation lives long enoughEliot Courtney
Currently, `GspSequencer` stores a raw DMA handle. Instead, store a reference to `Coherent` to statically ensure that the allocation lives long enough. Signed-off-by: Eliot Courtney <ecourtney@nvidia.com> Reviewed-by: Alistair Popple <apopple@nvidia.com> Link: https://patch.msgid.link/20260703-blackwell-fixes-v2-4-8e3d8bc32bb9@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-23gpu: nova-core: gsp: ensure lifetime for FMC boot DMA allocationsEliot Courtney
Currently, `FmcBootArgs` takes DMA handles directly, rather than references to the `Coherent` for them. This is error prone, so instead store lifetime'd references to the `Coherent` allocation. Signed-off-by: Eliot Courtney <ecourtney@nvidia.com> Link: https://patch.msgid.link/20260703-blackwell-fixes-v2-3-8e3d8bc32bb9@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-23gpu: nova-core: fsp: catch bogus queue pointer issuesEliot Courtney
Currently, `poll_msgq` will report a message of size 4 if the queue pointers are broken. It's easy to catch this if it occurs, so have `poll_msgq` return an error in this case. Signed-off-by: Eliot Courtney <ecourtney@nvidia.com> Reviewed-by: Alistair Popple <apopple@nvidia.com> Link: https://patch.msgid.link/20260703-blackwell-fixes-v2-2-8e3d8bc32bb9@nvidia.com [acourbot: explicitly mention the error, add paragraph separator.] Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-22drm/xe/nvls: Drop force_probe requirementGustavo Sousa
NVL-S is stable enough for us to drop force_probe requirement. Let's do that. Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/20260722-nvl_s-drop-force_probe-v1-1-db944d940cff@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-07-22mshv: Fix sleeping under spinlock in mshv_portid_allocStanislav Kinsburskii
idr_alloc() is called with GFP_KERNEL inside idr_lock(), which holds a spinlock. GFP_KERNEL allows the allocator to sleep, triggering a sleeping-while-atomic bug. Fix by using idr_preload(GFP_KERNEL) before taking the lock to pre-allocate memory in a sleepable context, then idr_alloc() with GFP_NOWAIT inside the spinlock-protected section. Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-22mshv: Fix duplicate GSI detection for GSI 0Stanislav Kinsburskii
The duplicate routing entry check in mshv_update_routing_table() uses guest_irq_num != 0 to detect whether a GSI slot is already occupied. This fails for GSI 0 because its guest_irq_num is 0 both when the slot is unused (zero-initialized) and when legitimately assigned. As a result, duplicate entries for GSI 0 are silently accepted, with the second entry overwriting the first — corrupting the routing table without any error reported to userspace. While GSI 0 (legacy timer) is unlikely to appear in MSI-based routing in practice, the check is semantically wrong — it conflates "uninitialized" with "GSI number 0." Use girq_entry_valid instead, which is explicitly set to true when an entry is populated and remains zero for unused slots regardless of the GSI number. Fixes: 621191d709b14 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-22Drivers: hv: vmbus: Remove vmbus_irq_initializedSebastian Andrzej Siewior
vmbus_irq_initialized is only true if the registration of the per-CPU threads succeeded. If it failed, the whole registration aborts and the vmbus_exit() path is never called. Remove vmbus_irq_initialized. Reviewed-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-22Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotationSebastian Andrzej Siewior
lockdep_hardirq_threaded() is supposed to be used within IRQ core code and not within drivers. It is not obvious from within the driver, that this is the only interrupt service routing and that it is not shared handler. Replace lockdep_hardirq_threaded() with a lockdep annotation limiting threaded context on PREEMPT_RT to __vmbus_isr(). Fixes: f8e6343b7a89c ("Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT") Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-22mshv_vtl: fix fd leak in mshv_ioctl_create_vtl()Yi Xie
put_unused_fd() if anon_inode_getfile() fails. Fixes: 7bfe3b8ea6e30 ("Drivers: hv: Introduce mshv_vtl driver") Signed-off-by: Yi Xie <xieyi@kylinos.cn> Reviewed-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-22mshv_vtl: clear hypercall output before copyoutYousef Alhouseen
mshv_vtl_hvcall_call() copies output_size bytes to userspace. The output page is freshly allocated. Userspace chooses the copyout length. If the hypercall writes less, the tail can contain stale page data. Clear the copied range before issuing the hypercall. Also check both bounce page allocations before either page is used. Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-22Drivers: hv: vmbus: Set DMA coherent mask for VMBus devicesMichael Kelley
In current code, the coherent_dma_mask for VMBus devices is not set, so it has the default value of 0, which essentially means "invalid". Because drivers for VMBus devices do not use dma_alloc_*() functions, the usual use of the coherent mask does not occur, and no errors result. However, a valid coherent_dma_mask may be needed even though the drivers don't use dma_alloc_*() functions. In a CoCo VM, the VMBus storvsc and netvsc drivers must bounce buffer DMA operations through the swiotlb because the Hyper-V host can't DMA into encrypted guest memory. If the kernel is built with CONFIG_SWIOTLB_DYNAMIC and the initial swiotlb size is small, swiotlb code may need to grow the swiotlb in response to a DMA mapping request. That growth first allocates a transient pool while the swiotlb is expanded in the background. The transient pool memory is allocated from the DMA atomic pools, and the allocation code checks for a valid coherent_dma_mask. With current code, this check fails, then the DMA mapping request from the storvsc or netvsc driver fails, and finally an I/O error occurs. Fix this problem by setting coherent_dma_mask for VMBus devices at the same time that dma_mask is set. Being a synthetic bus, VMBus does not have any restrictions on coherent DMA, so the coherent mask is set to the full 64 bits for all VMBus devices, just like with dma_mask. Signed-off-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-22drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2Guangshuo Li
mtk_hdmi_common_probe() gets the DDC adapter with of_find_i2c_adapter_by_node() and registers a devm action to release the adapter device reference with put_device(). The HDMI v2 remove callback also calls i2c_put_adapter() on the same DDC adapter. This is not paired with of_find_i2c_adapter_by_node(): it drops the adapter device reference before the devm action drops it again, and it also puts a module reference that was never taken. Remove the extra i2c_put_adapter() call and drop the now-empty HDMI v2 remove callback. The common devm action releases the adapter device reference. Fixes: 8d0f79886273 ("drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188") Cc: stable@vger.kernel.org Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Reviewed-by: CK Hu <ck.hu@mediatek.com> Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260713112957.884640-1-lgs201920130244@gmail.com/ Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
2026-07-22drm/mediatek: Check CRTC state before freeingRuoyu Wang
mtk_crtc_reset() destroys the current CRTC state only when crtc->state is non-NULL, but it always converts crtc->state to struct mtk_crtc_state and passes the result to kfree(). When reset is called without an existing state, container_of(NULL, ...) does not produce NULL. Keep the mtk state free in the same crtc->state guard as the helper state destruction. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 2d267b81898e ("drm/mtk: Use __drm_atomic_helper_crtc_reset") Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Reviewed-by: CK Hu <ck.hu@mediatek.com> Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260707150528.2270739-1-ruoyuw560@gmail.com/ Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
2026-07-22drm/xe/vm: Use regular comment for GSC VM lockdep note in xe_vm_create()Shuicheng Lin
The block comment describing the GSC VM lockdep annotation uses the kernel-doc opening marker (/**), but it is an in-function implementation note rather than API documentation. Per Documentation/doc-guide/kernel-doc.rst, /** is reserved for kernel-doc comments describing functions, structs, and other API elements, and using it for other comments can confuse kernel-doc tooling. Switch it to a regular block comment (/*). No functional change. Cc: Matthew Brost <matthew.brost@intel.com> Assisted-by: Claude:claude-opus-4.7 Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260721205516.4058959-4-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-07-22drm/xe/vm: Remove redundant INIT_WORK() for rebind_work in xe_vm_create()Shuicheng Lin
xe_vm_create() initializes vm->preempt.rebind_work twice for LR-mode VMs: once in the LR-mode setup block before xe_svm_init(), and again inside the xe_validation_guard() block. The second call is a no-op on top of the first since the work is never queued between them, but re-initializing a work item is unnecessary and makes lifetime and ordering harder to reason about (e.g., any future change that queues the work earlier would be silently corrupted by the second INIT_WORK). Drop the duplicate INIT_WORK() and keep only the batch_invalidate_tlb flag handling in the later LR-mode block. The single INIT_WORK() call in the earlier LR-mode setup block remains the sole initialization. No functional change. Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Assisted-by: Claude:claude-opus-4.7 Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260721205516.4058959-3-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-07-22drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()Shuicheng Lin
Commit 9e9787414882 ("drm/xe/userptr: replace xe_hmm with gpusvm") made xe_svm_init() unconditional in xe_vm_create() and extended it to also initialize a "simple" gpusvm state for non-fault-mode VMs. The matching xe_svm_fini() call in xe_vm_close_and_put() was updated to run unconditionally, but the error unwind path in xe_vm_create() was not. On the drm_gpuvm_resv_object_alloc() failure path, xe_svm_init() has already succeeded but xe_svm_fini() is only called when XE_VM_FLAG_FAULT_MODE is set. For non-fault-mode VMs this leaves vm->svm.gpusvm partially initialized and leaks the resources allocated by drm_gpusvm_init(). For fault-mode VMs, xe_svm_init() additionally acquires the pagemap owner via drm_pagemap_acquire_owner() and the pagemaps via xe_svm_get_pagemaps(). Those resources are released by xe_svm_close(), not xe_svm_fini(). On the same error path, xe_svm_close() is not called either, so fault-mode VMs leak the pagemap owner and pagemaps. Fix both leaks: - Call xe_svm_fini() unconditionally on the err_svm_fini path, matching the unconditional xe_svm_init() call. Move the vm->size = 0 assignment out of the conditional so the xe_vm_is_closed() assert in xe_svm_fini() (and xe_svm_close()) holds for both modes. - Call xe_svm_close() for fault-mode VMs before xe_svm_fini(), matching the ordering used in xe_vm_close_and_put(). Fixes: 9e9787414882 ("drm/xe/userptr: replace xe_hmm with gpusvm") Cc: Matthew Auld <matthew.auld@intel.com> Assisted-by: Claude:claude-opus-4.7 Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260721205516.4058959-2-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-07-22cpufreq: dt-platdev: Add SpacemiT K1 SoC to the allowlistShuwei Wu
Add the compatible string for supporting the generic cpufreq driver on the SpacemiT K1 SoC. Signed-off-by: Shuwei Wu <shuwei.wu@mailbox.org> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Reviewed-by: Yixun Lan <dlan@kernel.org> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Tested-by: Milan P. Stanić <mps@arvanta.net> Tested-by: Gong Shuai <gsh517025@gmail.com> # OrangePi-RV2 Link: https://patch.msgid.link/20260626-shadow-deps-v4-1-bba9831f2f1d@mailbox.org Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-07-22net: sxgbe: fix null pointer dereference in probe error pathChenguang Zhao
The platform drvdata is not set until all IRQs have been mapped, so the local net_device pointer is NULL when IRQ mapping fails. Remove the device allocated by sxgbe_drv_probe() through priv instead. Cc: stable+noautosel@kernel.org # untested fix to unlikely driver error path Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260717091423.1557737-1-chenguang.zhao@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-22net: phy: motorcomm: Enable optional clock for YT8531Yanan He
Some boards feed the YT8531 PHY from an SoC-provided external reference clock described by the common ethernet-phy "clocks" property. Enable the optional PHY clock during probe so boards can model this clock as a PHY input instead of keeping the clock alive from the MAC driver. This is needed on the Alientek DLRV1126, where the PHY reference clock is provided by CLK_GMAC_ETHERNET_OUT. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Yanan He <grumpycat921013@gmail.com> Link: https://patch.msgid.link/20260714-motorcomm-yt8531-clk-v3-1-10dc303ef1a5@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-22net: mdio: Kconfig: Group mdio multiplexers in a submenuMaxime Chevallier
Move all MDIO muxes under the "MDIO controller drivers" submenu. This doesn't change any dependency for KConfig options and is purely cosmetic. Suggested-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260715082226.51481-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-22net: mdio: Kconfig: Group mdio controller drivers in a submenuMaxime Chevallier
Currently, all inidivual drivers for MDIO bus controllers are directly listed under Device drivers -> Network device support. Let's group them altogether in a submenu, while keeping the dependency on PHYLIB. No intended functional change besides the menuconfig ordering. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260715082226.51481-2-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-22spi: spacemit: prepare both DMA descriptors before submittingSurendra Singh Chouhan
k1_spi_dma_one() currently submits the TX DMA descriptor to the DMA engine before preparing the RX DMA descriptor. If preparing the RX descriptor subsequently fails, the function jumps to the fallback error path without canceling or aborting the already submitted TX DMA descriptor. Fix this by preparing both the TX and RX descriptors before submitting either of them to the DMA engine. Fixes: efcd8b9d1111 ("spi: spacemit: introduce SpacemiT K1 SPI controller driver") Reviewed-by: Alex Elder <elder@riscstar.com> Signed-off-by: Surendra Singh Chouhan <kr494167@gmail.com> Link: https://patch.msgid.link/20260722162444.11415-1-kr494167@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-22net: dsa: mt7530: add EN7528 supportAhmed Naseef
The EcoNet EN7528 SoC integrates an MT7530 switch (the chip revision register reads 0x7530), memory-mapped in the SoC register space and reached through the same MMIO glue used for the built-in switches of the MediaTek MT7988 and Airoha EN7581/AN7583 SoCs. Its reset sequence and its PHY indirect access registers are the same as on those switches, so add an ID_EN7528 variant bound with the "econet,en7528-switch" compatible, reusing mt7988_setup() and the indirect PHY accessors. The switch core, however, is an MT7530 and not an MT7531 derivative: the CPU port to trap frames to is set through the MT7530-style CPU_EN / CPU_PORT fields of the MFC register rather than the MT7531 CFC register, so add it to the MT7530 handling in mt753x_conduit_state_change(). For the same reason the MT7530 mirror and force-mode register layouts already apply to it as the default of the MT753X_*() macros. The four user ports (1-4) are connected to integrated Gigabit PHYs at MDIO addresses 9-12 of the switch internal MDIO bus. The CPU port (port 6) is connected to the SoC Ethernet MAC at a fixed 1000 Mbps full duplex link, so the port capabilities cannot be shared with the MT7988 and EN7581 switches, whose CPU ports run at 10 Gbps. The LAN GPHYs advertise EEE by default, but negotiating EEE with some link partners results in an unstable link with dropped frames. Leave the LPI capabilities empty for the EN7528 so that phylink disables EEE on these PHYs and refuses to enable it from userspace. Signed-off-by: Ahmed Naseef <naseefkm@gmail.com> Link: https://patch.msgid.link/8c7dfabd860ab0a6dd771c2bac7b7599eb369a4f.1783770059.git.naseefkm@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-22vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packetsHarshaka Narayana
vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header instead, signalled by the VMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Since the function never skips the outer encapsulation, this mismatch triggers: - BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP), because the outer protocol is UDP (Geneve), not TCP. - BUG_ON(hdr.eth->h_proto != ...), when the tunnel's outer and inner IP versions differ (e.g. outer IPv6/inner IPv4 or vice versa). Check VMXNET3_RCD_HDR_INNER_SHIFT up front and bail out, since the function cannot locate the inner header it would need to parse. Also convert the remaining BUG_ON()s in this function to return 0 defensively. Fixes: 45dac1d6ea04 ("vmxnet3: Changes for vmxnet3 adapter version 2 (fwd)") Signed-off-by: Harshaka Narayana <harshaka.narayana@broadcom.com> Reviewed-by: Ronak Doshi <ronak.doshi@broadcom.com> Reviewed-by: Sankararaman Jayaraman <sankararaman.jayaraman@broadcom.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260713140915.3381715-1-harshaka.narayana@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-22PCI: Do not add hotplug reservation multiple timesIlpo Järvinen
In nested topologies, hotplug reservations get added multiple times into the bridge window higher up in the hierarchy. Adding reservations for intermediate level bridges does not seem very useful because the hotplug is going to add device at a leaf. Accounting the hotplug reservation multiple times results in larger than expected bridge window size that may lead to assignment failures as shown in this log: pci_bus 0000:0a: root bus resource [mem 0x10a00000-0x10c00fff window] pci 0000:0a:00.0: BAR 0 [mem 0x10c00000-0x10c00fff] pci 0000:0a:00.0: bridge window [mem 0x10a00000-0x10bfffff] pci 0000:0b:00.0: bridge window [mem 0x10a00000-0x10bfffff] pci 0000:0c:02.0: bridge window [mem 0x10a00000-0x10bfffff] pci 0000:0c:02.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 0d] add_size 200000 add_align 100000 pci 0000:0c:02.0: bridge window [mem 0x00100000-0x000fffff] to [bus 0d] add_size 200000 add_align 100000 pci 0000:0b:00.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 0c-0d] add_size 200000 add_align 100000 pci 0000:0b:00.0: bridge window [mem 0x00100000-0x000fffff] to [bus 0c-0d] add_size 200000 add_align 100000 pci 0000:0a:00.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 0b-0d] add_size 400000 add_align 100000 pci 0000:0a:00.0: bridge window [mem 0x00100000-0x000fffff] to [bus 0b-0d] add_size 400000 add_align 100000 pci 0000:0a:00.0: bridge window [mem size 0x00400000]: can't assign; no space pci 0000:0a:00.0: bridge window [mem size 0x00400000]: failed to assign pci 0000:0a:00.0: bridge window [mem size 0x00400000 64bit pref]: can't assign; no space pci 0000:0a:00.0: bridge window [mem size 0x00400000 64bit pref]: failed to assign The problem stems from calculate_memsize() that calculates size first and then adds childen size: size = max(0, 2M) + 2M Alter the logic to first account for the children size before applying the hotplug reservation to not add hotplug reservation multiple times on different levels of a nested topology. As a result, the size calculation becomes: size = max(0 + 2M, 2M) Reported-by: Eric Auger <eauger@redhat.com> Link: https://lore.kernel.org/linux-pci/f23946f2-06ac-4607-8f2c-3ffbc52b627a@redhat.com/ Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260720162416.5771-1-ilpo.jarvinen@linux.intel.com
2026-07-22drm/gma500: return errors from Oaktrail HDMI I2C readsPengpeng Hou
xfer_read() waits for the HDMI I2C transaction to reach I2C_TRANSACTION_DONE, but it ignores both timeout and signal returns from wait_for_completion_interruptible_timeout(). If the interrupt never advances the transaction state, the loop can wait forever. Return -ETIMEDOUT when the completion wait expires, propagate interrupted waits, and make the I2C master_xfer callback return the first transfer error instead of reporting a successful message count. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com> Link: https://patch.msgid.link/20260625003240.6923-1-pengpeng@iscas.ac.cn
2026-07-22virt: arm-cca-guest: Drop unused assignment of platform_device_id driver dataUwe Kleine-König (The Capable Hub)
The driver explicitly sets the .driver_data member of struct platform_device_id to zero without relying on that value. Drop this unused assignment. While touching this array use a named initializer for .name. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-22vxlan: mdb: Fix source list corruption on a failed replaceJames Raphael Tiovalen
When replacing the source list of an MDB remote entry, all existing sources are first marked for deletion and vxlan_mdb_remote_srcs_add() is then called to add the new source list. Sources present in the new list have their deletion mark cleared, and any sources left marked afterwards are removed. If vxlan_mdb_remote_srcs_add() fails partway through, its error path deletes all entries on the remote's source list. That rollback is only correct for its other caller, vxlan_mdb_remote_add(), where the remote was just allocated and the list contains solely entries added during the call. On the replace path the list also holds pre-existing sources, so a failed replace tears them down together with their (S, G) forwarding entries instead of leaving the entry unchanged. This is reachable from an existing (*, G) remote. An EXCLUDE filter that loses sources starts forwarding traffic that should be blocked, while an INCLUDE filter that loses sources drops traffic that should be forwarded. Mark entries created during the current pass with a new VXLAN_SGRP_F_NEW flag. On failure, delete only those entries and clear the deletion mark on the pre-existing ones, so a failed replace leaves the source list untouched. Retain the flag until the whole operation succeeds and then clear it. Also stop vxlan_mdb_remote_src_add() from deleting a pre-existing entry it only looked up when adding that entry's forwarding entry fails. Fixes: a3a48de5eade ("vxlan: mdb: Add MDB control path support") Cc: stable@vger.kernel.org Signed-off-by: James Raphael Tiovalen <jamestiotio@gmail.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: Antoine Tenart <atenart@kernel.org> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260720160428.249356-1-jamestiotio@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-22net: stmmac: dwmac4: mask interrupts when stopping DMA in suspendLuis Lang
Since commit 1b9707e6f1a9 ("net: stmmac: enable RPS and RBU interrupts"), suspending causes an interrupt storm from the RPS interrupt. Fix this by adding a deinit_chan() op to stmmac_dma_ops, which masks all default dma channel interrupts. This is called from stmmac_stop_all_dma(), so interrupts don't trigger while suspending. Fixes: 1b9707e6f1a9 ("net: stmmac: enable RPS and RBU interrupts") Suggested-by: Andrew Lunn <andrew@lunn.ch> Suggested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Signed-off-by: Luis Lang <luis.la@mail.de> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260720111534.163416-1-luis.la@mail.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-22ACPI: CPPC: add paired FFH feedback-counter read hookPengjie Zhang
cppc_get_perf_ctrs() reads the delivered and reference performance counters one at a time. Allow architectures to provide both FFH feedback counters in one operation when that either narrows the sampling window or avoids extra cross-CPU reads. Add a small FFH-specific hook for that case and fall back to the existing per-register reads when unsupported. Tested-by: Sumit Gupta <sumitg@nvidia.com> Reviewed-by: Sumit Gupta <sumitg@nvidia.com> Tested-by: Vanshidhar Konda <vanshikonda@os.amperecomputing.com> Reviewed-by: Vanshidhar Konda <vanshikonda@os.amperecomputing.com> Signed-off-by: Pengjie Zhang <zhangpengjie2@huawei.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Tested-by: Jeremy Linton <jeremy.linton@arm.com> Reviewed-by: Jeremy Linton <jeremy.linton@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-22net: dpaa: fix mode settingMichael Walle
Before converting to the phylink interface, the init function would have set a non-reserved I/F mode in the maccfg2 register. After converting to phylink, 0 is written as mode, which is a reserved value (although it's the hardware default). Without a valid mode, a SGMII link is never established between the MAC and the PHY and thus .link_up() is never called which could set the correct mode according to the actual speed. Fix it by setting the maximum speed of the phy_interface_t in use in .mac_config() - just like the driver did before the phylink conversion. Fixes: 5d93cfcf7360 ("net: dpaa: Convert to phylink") Suggested-by: Sean Anderson <sean.anderson@linux.dev> Signed-off-by: Michael Walle <mwalle@kernel.org> Reviewed-by: Sean Anderson <sean.anderson@linux.dev> Reviewed-by: Sean Anderson <sean.anderson@linux.dev> Link: https://patch.msgid.link/20260717132401.2653252-1-mwalle@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-22media: s5p-mfc: Treat bitmap size as allocation failureYury Norov
bitmap_find_next_zero_area() uses an out-of-range return value to indicate failure. Check for values greater than or equal to the bitmap size so the caller does not depend on the exact failure sentinel. Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Yury Norov <ynorov@nvidia.com>
2026-07-22crypto: ccp: Treat bitmap size as allocation failureYury Norov
bitmap_find_next_zero_area() uses an out-of-range return value to indicate failure. Accept only offsets strictly below the bitmap size so the callers do not depend on the exact failure sentinel. Signed-off-by: Yury Norov <ynorov@nvidia.com>
2026-07-22perf: Use sysfs_emit() for cpumask show callbacksYury Norov
These callbacks are sysfs show paths. Use sysfs_emit() and cpumask_pr_args() to emit the masks. This prepares for removing cpumap_print_to_pagebuf(). Link: https://lore.kernel.org/all/akANJ-AT7nHpRMq-@yury/ Acked-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Yury Norov <ynorov@nvidia.com>
2026-07-22PCI/sysfs: Use sysfs_emit() for cpumask show callbacksYury Norov
These callbacks are sysfs show paths. Use sysfs_emit() and cpumask_pr_args() to emit the masks. This prepares for removing cpumap_print_to_pagebuf(). Signed-off-by: Yury Norov <ynorov@nvidia.com>