summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-07-26nfc: Unify style of spi_device_id arraysUwe Kleine-König (The Capable Hub)
Unify the style of the list terminator in spi_device_id arrays, that is use a single space between { and }. This is the most common and generally recommended style for these. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/78d632098fd42dbf2846cb89d66ec83bb9e1de99.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: Initialize spi_device_idarrays using member namesUwe Kleine-König (The Capable Hub)
While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. The mentioned robustness is relevant for a planned change to struct spi_device_id that replaces .driver_data by an anonymous union. This patch doesn't modify the compiled arrays, only their representation in source form benefits. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/308a0d43ef042566ca595f1afa803cac592a4643.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: Drop unused assignment of spi_device_id driver dataUwe Kleine-König (The Capable Hub)
The drivers explicitly set the .driver_data member of struct spi_device_id to zero without relying on that value. Drop these unused assignments. This patch doesn't modify the compiled arrays, only their representation in source form benefits. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/c645d5855d26307d6164122412335533febbf8b9.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: Unify style of of_device_id arraysUwe Kleine-König (The Capable Hub)
The most common style treewide is: - A single space in the list terminator and no trailing , - No comma after a named initializers iff the closing } is on the same line Adapt the of_device_id arrays accordingly. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Ian Ray <ian.ray@gehealthcare.com> Link: https://patch.msgid.link/583375dcd834f5edf6241b09cdd75ad4f32af668.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: Drop __maybe_unused from of_device_id tablesUwe Kleine-König (The Capable Hub)
Referencing these arrays in MODULE_DEVICE_TABLE() is enough to convince the compiler that they are used even if the drivers are built-in (since 5ab23c7923a1 ("modpost: Create modalias for builtin modules"). So the __maybe_unused marking can be removed without introducing a compiler warning. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/031ea0ae38838df3261f844eb13e9841769b49a7.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: Initialize mei_cl_device_idarrays using member namesUwe Kleine-König (The Capable Hub)
While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. The mentioned robustness is relevant for a planned change to struct mei_cl_device_id that replaces .driver_data by an anonymous union. This patch doesn't modify the compiled arrays, only their representation in source form benefits. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/cdc9bbac2e0743550970e565f57996c8a833446f.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: pn544: Drop empty line between i2c_device_id array and ↵Uwe Kleine-König (The Capable Hub)
MODULE_DEVICE_TABLE() Usually there is no empty line between a module device table and the respective MODULE_DEVICE_TABLE(): $ git grep -h -B1 ^MODULE_DEVICE_TABLE v7.1-rc1 | sort | uniq -c | sort -n ... 1388 8129 }; 9784 -- (The `--` is part of grep output to separate the matches with their context from each other, that's not the most usual line before MODULE_DEVICE_TABLE(...).) Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/7562d0062948a474957d8d733c0e8a70de502624.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: Unify style of acpi_device_id arraysUwe Kleine-König (The Capable Hub)
Unify the style of the list terminator in acpi_device_id arrays, that is use a single space between { and }. This is the most common and generally recommended style for these. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/30cd94a6821917f16daffdce5fabf145432c13eb.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: Initialize acpi_device_id arrays using member namesUwe Kleine-König (The Capable Hub)
While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. The mentioned robustness is relevant for a planned change to struct acpi_device_id that replaces .driver_data by an anonymous union. This patch doesn't modify the compiled arrays, only their representation in source form benefits. The former was confirmed with x86 and arm64 builds. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Ian Ray <ian.ray@gehealthcare.com> Link: https://patch.msgid.link/5f60cd3e9831aac3995ed1a1b074ca1ae32e5286.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: Drop unused assignment of acpi_device_id driver dataUwe Kleine-König (The Capable Hub)
The drivers explicitly set the .driver_data member of struct acpi_device_id to zero without relying on that value. Drop these unused assignments. This patch doesn't modify the compiled arrays, only their representation in source form benefits. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/c77f6376214001297f28d3ec48f0a853985f1847.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: Drop __maybe_unused from acpi_device_id tablesUwe Kleine-König (The Capable Hub)
Referencing these arrays in MODULE_DEVICE_TABLE() is enough to convince the compiler that they are used even if the drivers are built-in (since 5ab23c7923a1 ("modpost: Create modalias for builtin modules"). So the __maybe_unused marking can be removed without introducing a compiler warning. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/4c25d7a7f81d5117cd5d0de4a9f06ed0552e8793.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: nxp-nci: Add remove on IRQ errorGriffin Kroah-Hartman
Add a call to nxp_nci_remove() in nxp_nci_i2c_probe() when the request_threaded_irq() fails. Previously, IRQ resources were not being freed upon error. Assisted-by: gkh_clanker_2000 Cc: David Heidelberg <david@ixit.cz> Cc: Carl Lee <carl.lee@amd.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Cc: Ian Ray <ian.ray@gehealthcare.com> Cc: "Uwe Kleine-König (The Capable Hub)" <u.kleine-koenig@baylibre.com> Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Ian Ray <ian.ray@gehealthcare.com> Link: https://patch.msgid.link/2026070726-observer-fang-9716@gregkh Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: mrvl: spi: Unregister dev on allocation failGriffin Kroah-Hartman
Call nfcmrvl_nci_unregister_dev() if nci_spi_allocate_spi() fails, unwrapping the previous call to nfcmrvl_nci_register_dev() during the nfcmrvl_spi_probe() function. Assisted-by: gkh-clanker-2000 Cc: David Heidelberg <david@ixit.cz> Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/2026070716-crucial-slouchy-b8a9@gregkh Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: pn533: hold a reference to the request skb during send_frameYinhao Hu
__pn533_send_async() publishes the command and then calls dev->phy_ops->send_frame(). Once dev->cmd is set, an incoming frame can be matched to this command: the I2C threaded IRQ runs pn533_recv_frame(), which queues cmd_complete_work, and pn533_send_async_complete() frees cmd->req with consume_skb(). On the I2C transport, pn533_i2c_send_frame() still dereferences the same skb after i2c_master_send() returns, so a completion that races the send can free the skb while the transport is still using it. The request skb is owned by the command object and may be freed by command completion at any time after dev->cmd is published, so the transport send path must not assume it stays alive. Hold a temporary reference to the request skb across the send_frame() call so the transport always sees a live skb even if completion races the send. Add a pn533_send_cmd_frame() helper and use it from all three send paths. Fixes: 9815c7cf22da ("NFC: pn533: Separate physical layer from the core implementation") Signed-off-by: Yinhao Hu <dddddd@hust.edu.cn> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260626073434.3977525-1-dddddd@hust.edu.cn Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: trf7970a: Use NULL when no response is expectedLinmao Li
When a command's timeout is zero, no response is expected, and the TX interrupt handler completes the command by passing ERR_PTR(0) to the digital callback. ERR_PTR(0) evaluates to NULL, so no errno is encoded here. Use NULL directly to avoid suggesting that this is an error-pointer path. Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Link: https://patch.msgid.link/20260706075743.564658-1-lilinmao@kylinos.cn Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: fdp: bound the device-reported read length and fix an skb leakBryam Vargas
fdp_nci_i2c_read() takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 used as the i2c_master_recv() count into a 261-byte on-stack buffer: a malicious, counterfeit or malfunctioning controller (or an i2c bus interposer) can drive it far past the buffer for a stack out-of-bounds write that clobbers the canary and return address, or below the minimum frame size (directly, or by truncating the computed sum) so the header/LRC strip and the next length read run past a short receive. Reject a length outside [FDP_NCI_I2C_MIN_PAYLOAD, FDP_NCI_I2C_MAX_PAYLOAD], as a corrupted packet already is, and force resynchronization. The same loop allocates one data skb per iteration and assumes a length packet followed by a data packet; a device that sends two data packets in one call leaks the first skb when the second allocation overwrites it. Free a previously allocated skb before allocating the next. Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver") Cc: stable@vger.kernel.org Suggested-by: Simon Horman <horms@kernel.org> Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Link: https://patch.msgid.link/20260616-b4-disp-b1f8ab4c-v2-1-2d1fe5955325@proton.me Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26nfc: pn533: fix memcpy overflow warningRosen Penev
error: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning] As suggested, add a struct_group and memcpy that. Also replace 9 with sizeof for clarify. Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260608050034.5679-1-rosenp@gmail.com Signed-off-by: David Heidelberg <david@ixit.cz>
2026-07-26scsi: libiscsi: Fix stale-data leak into the SCSI sense bufferHyeongJun An
iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >= senselen: senselen = get_unaligned_be16(data); if (datalen < senselen) goto invalid_datalen; memcpy(sc->sense_buffer, data + 2, min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE)); A target that returns a SCSI Response whose datalen equals senselen (with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace. Account for the 2-byte sense length prefix in the check. Fixes: 7996a778ff8c ("[SCSI] iscsi: add libiscsi") Suggested-by: Sashiko AI <sashiko-bot@kernel.org> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Acked-by: Chris Leech <cleech@redhat.com> Link: https://patch.msgid.link/20260714104934.1404423-1-sammiee5311@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26Merge tag 'spi-fix-v7.2-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "Just a couple of small bits for the SpacemiT driver - one small fix, and a new compatible in the DT binding" * tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: spacemit: add K3 SPI compatible spi: spacemit: Correct TX FIFO slot calculation
2026-07-26Merge tag 'regulator-fix-v7.2-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "One driver specific fix where one of the MediaTek drivers duplicated some core code buggily, and a core fix for an ordering issue on startup where we could end up configuring a voltage outside of constraints due to the order in which we applied constraints" * tag 'regulator-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: core: clamp voltage constraints before applying apply_uV regulator: mt6358: use regmap helper to read fixed LDO calibration
2026-07-26iio: chemical: sgp30: Handle IAQ thread creation failureLinmao Li
kthread_run() can fail and return an error pointer, but sgp_probe() stores it and returns success, so the device is registered without its IAQ thread and sgp_remove() later passes the error pointer to kthread_stop(). Return the error from probe instead. Fixes: ce514124161a ("iio: chemical: sgp30: Support Sensirion SGP30/SGPC3 sensors") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-26iio: magnetometer: add support for QST QMC6308Jorijn van der Graaf
The QST QMC6308 is a 3-axis anisotropic magnetoresistive (AMR) magnetometer on I2C, found e.g. in the Fairphone 6. Its register map is not compatible with the QMC5883L's, so add a separate driver rather than extending the QMC5883L driver. Support raw X/Y/Z reads, output data rate, field range, filter oversampling ratio, the mount matrix, and runtime PM. Run measurements in the chip's periodic "normal" mode paced by the DRDY flag rather than in its one-shot "single" mode: the datasheet specifies no conversion time that could bound a one-shot wait, while normal mode is paced by the specified output data rates, which also keeps the sampling_frequency ABI meaningful. Runtime PM puts the chip into its suspend mode after 500 ms without a reading, dropping supply current to a few microamps. The suspended chip retains its registers and keeps responding on I2C, so resuming only rewrites the mode field and discards one stale sample, and configuration changes apply even while suspended; VDD is left enabled across runtime suspend. Assisted-by: Claude:claude-fable-5 Signed-off-by: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-26Merge tag 'char-misc-7.2-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are a number of small char/misc/etc driver fixes for 7.2-rc5 that resolve a bunch of different reported issues. Included in here are: - rust_binder error message reporting fix - stratix10-svc firmware driver fixes - mei driver fix - intel_th hardware tracing driver fix - comedi driver fix - uio_hv_generic driver fix - ntsync selftest fix - nsm misc driver fix - some MAINTAINER file updates All of these have been in linux-next for over a week with no reported issues" * tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: MAINTAINERS: Update wine-devel list address rust_binder: only print failure if error has source intel_th: fix MSC output device reference leak misc: nsm: pin the module while the device is open mei: bus: access mei_device under device_lock on cleanup misc: nsm: only unlock nsm_dev on post-lock error paths selftests: ntsync: correct CONFIG_NTSYNC name comedi: comedi_parport: deal with premature interrupt uio_hv_generic: Bind to FCopy device by default MAINTAINERS: Add Greg Kroah-Hartman to GPIB firmware: stratix10-svc: fix teardown order in remove to prevent race firmware: stratix10-svc: handle NO_RESPONSE in async poll firmware: stratix10-svc: fix FCS SMC call kernel-doc firmware: stratix10-svc: fix memory leaks and list corruption bugs
2026-07-26Merge tag 'staging-7.2-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are two small staging driver fixes for 7.2-rc5. They both resolve some reported bugs in the rtl8723bs staging driver and have been in linux-next for over a week with no reported issues" * tag 'staging-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() staging: rtl8723bs: fix inverted HT40 secondary channel offset
2026-07-26Merge tag 'tty-7.2-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull serial driver fixes from Greg KH: "Here are two small serial driver fixes for 7.2-rc5. They are: - sc16is7xx get_direction() callback fix, which resolves a user-triggerable warning in the driver - NULL pointer dereference on some platforms using the 8250_mid serial driver Both have been in linux-next for over a week with no reported issues" * tag 'tty-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: sc16is7xx: implement gpio get_direction() callback serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
2026-07-26Merge tag 'usb-7.2-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes and new device quirks and ids: - usb storage quirk added - new usb serial device ids added - usb-serial device name leak and other bug fixes - small xhci driver fixes - normal batch of typec driver fixes for reported issues - usb-atm much-reported-by-syzbot fix for firmware download races - sysfs BOS device removal race fix - lots of usb gadget driver fixes for reported issues - other small USB driver fixes for other reported problems All of these have been in linux-next this past week, many of them much longer" * tag 'usb-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (30 commits) usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path USB: serial: io_edgeport: cap received transmit credits USB: serial: option: add TDTECH MT5710-CN USB: serial: io_ti: reject oversized boot-mode firmware USB: serial: mxuport: validate firmware header size usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect usb: typec: ucsi: yoga_c630: Remove redundant duplicate altmode handling usb: typec: ucsi: Add duplicate detection to nvidia registration path usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback usb: chipidea: fix usage_count leak when autosuspend_delay is negative usb: core: sysfs: add lock to bos_descriptors_read() usb: musb: omap2430: Do not put borrowed of_node in probe usb: core: port: Deattach Type-C connector on component unbind USB: storage: add NO_ATA_1X quirk for Longmai USB Key USB: serial: ftdi_sio: add support for E+H FXA291 USB: serial: keyspan_pda: fix data loss on receive throttling usb: gadget: printer: fix infinite loop in printer_read() usb: gadget: f_midi: cancel pending IN work before freeing the midi object usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown ...
2026-07-26iommu/iommufd: Fix IOPF group ownership UAFPeiyang He
iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted group in the IOMMUFD deliver list without removing it from the generic pending list. When detach or HWPT replacement drops the device's IOPF reference count to zero, an IOMMU driver may call iopf_queue_remove_device(). That function responds to and frees groups through the generic pending list without removing the same groups from IOMMUFD's deliver list or response xarray. A later read, response, or cleanup can then access the freed group and cause a UAF. Fix this by dequeuing an accepted group from the generic pending list before IOMMUFD queues it for userspace response. Make iopf_group_response() send a response regardless of pending-list membership, so the dequeued group can still be completed by IOMMUFD. Link: https://patch.msgid.link/r/3CFD314D0FE4D7EC+20260720085017.3998878-2-peiyang_he@smail.nju.edu.cn Closes: https://lore.kernel.org/all/B4F28798E2E784CA+d29f723c-b2b5-4b67-8d1c-4f7b9b0b27cb@smail.nju.edu.cn/ Fixes: 34765cbc679c ("iommufd: Associate fault object with iommufd_hw_pgtable") Cc: stable@vger.kernel.org Tested-by: Peiyang He <peiyang_he@smail.nju.edu.cn> Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-07-26iommu/rockchip: Clear stale page faults before enabling stallJiaxing Hu
Boot firmware can leave an IOMMU bank in PAGE_FAULT_ACTIVE before the driver has configured paging: PAGE_FAULT_ACTIVE=1 STALL_ACTIVE=0 IDLE=1 Such a bank ignores CMD_ENABLE_STALL and never reaches STALL_ACTIVE, so rk_iommu_enable_stall()'s readx_poll_timeout() spins until it times out (seen on the RK3576 NPU, whose MMUs share this poll across banks). Rather than special-casing these banks in the stall path, acknowledge the stale fault with CMD_PAGE_FAULT_DONE before enabling stall, so every bank starts from a clean state and the normal stall sequence applies to all of them. Banks without a pending fault are untouched. Signed-off-by: Jiaxing Hu <gahing@gahingwoo.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-26iommu/rockchip: Take all DT clocksJiaxing Hu
rk_iommu only enabled a fixed {aclk,iface} pair. On the RK3576 NPU the MMU sits behind the CBUF/DSU gates, so writes to DTE_ADDR are silently dropped until those clocks run too (reads work, writes need more clocks). Use devm_clk_bulk_get_all() to take every clock the devicetree provides instead of a fixed pair, so a platform can list the full set it needs. Clocks stay optional for the older clock-less devicetrees. Signed-off-by: Jiaxing Hu <gahing@gahingwoo.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-26iommu/rockchip: Fix silent probe success when all MMU resources failZhaoJinming
When all MMU register mappings fail in rk_iommu_probe(), the error path returns PTR_ERR(iommu->bases[0]). However, bases[0] can be NULL if the first platform_get_resource() also returned NULL, causing PTR_ERR(NULL) to evaluate to 0 and the probe to succeed silently. Return -ENODEV directly instead. Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-26iommu/rockchip: Drop global rk_ops in favor of per-device opsSimon Xue
The driver currently uses a global rk_ops pointer, forcing all IOMMU instances to share the same operations. This restricts the driver from supporting SoCs that might integrate different versions of IOMMU hardware. Since the IOMMU framework passes the master device information to iommu_paging_domain_alloc(), the global variable is no longer needed. Fix this by moving rk_ops into struct rk_iommu and struct rk_iommu_domain. Initialize it per-device during probe via of_device_get_match_data(), and replace all global references with the instance-specific pointers. Signed-off-by: Simon Xue <xxm@rock-chips.com> Reviewed-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-26RDMA/cxgb4: remove dead NULL checks after GFP_NOFAIL allocationsGou Hao
alloc_skb() with the __GFP_NOFAIL flag will never return NULL, so the subsequent NULL checks and error handling are unreachable dead code. Remove them. Signed-off-by: Gou Hao <gouhao@uniontech.com> Link: https://patch.msgid.link/20260724022851.466017-7-gouhao@uniontech.com Reviewed-by: Potnuri Bharat Teja <bharat@chelsio.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/rxe: Implement disassociate_ucontext callbackJiri Pirko
Implement an empty disassociate_ucontext() callback so the RDMA core can move rxe devices between net namespaces. The core requires this callback to reset user contexts without waiting for userspace. rxe needs no teardown here: its user-mapped queues live in reference-counted vmalloc memory (see rxe_mmap.c) that stays valid while userspace holds the mappings. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-14-jiri@resnulli.us Reviewed-by: Yanjun Zhu <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/rxe: Allow queue VMAs to outlive ucontextsJiri Pirko
Prepare queue mappings for asynchronous ucontext disassociation during device disable. Rely on the VMA page references to preserve mapped memory until the final unmap. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-13-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Make device names unique per net namespaceJiri Pirko
Use rdma_dev_access_netns() to scope RDMA device name lookup and "%d" name allocation to the relevant net namespace. Keep shared mode and CONFIG_NET_NS=n behaviour system-wide. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-12-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Document the SELinux ibendport net namespace limitationJiri Pirko
Document that SELinux ibendport labels use a global (device name, port) key, so same-named RDMA devices in different net namespaces share a label. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-11-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/cma: Document that CM configfs cannot be net namespace scopedJiri Pirko
Document the rdma_cm configfs limitation: configfs is global, so same-named RDMA devices in different net namespaces cannot both be represented there. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-10-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/cgroup: Disambiguate devices across net namespacesJiri Pirko
RDMA device names are unique only within a network namespace, but an RDMA cgroup can account resources for devices from multiple namespaces. Duplicate names therefore make cgroup output ambiguous and can cause limit writes to select the wrong device. Use the system-wide RDMA device index to distinguish duplicate names while preserving the existing UAPI for unique names. Reject ambiguous name-only writes with -ENOTUNIQ and expose a complete device view to administrators. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-9-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/srp: Make the SRP sysfs class net namespace awareJiri Pirko
Tag srp_class by the RDMA device's net namespace so SRP hosts derived from same-named RDMA devices can coexist across namespaces. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-8-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/nldev: Allow setting the device name while changing net namespaceJiri Pirko
Accept RDMA_NLDEV_ATTR_DEV_NAME together with RDMA_NLDEV_NET_NS_FD so a netlink move can rename the device in the destination namespace. Keep the name semantics aligned with the existing RDMA rename path. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-6-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/nldev: Report net namespace move errors through extackJiri Pirko
Thread extack through the existing net namespace move helper and report the main failure reasons from the core path. Keep the existing move UAPI shape unchanged. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-5-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Support renaming a device when changing its net namespaceJiri Pirko
Allow namespace moves to request a destination device name. Keep requested names on the same literal-name path as the existing RDMA rename operation, and keep teardown fallback naming on the trusted kernel-controlled path. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-4-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Handle device name conflicts when changing net namespaceJiri Pirko
Prepare namespace moves for per-netns names. Check user-initiated moves for destination-name conflicts before disabling the device, keep same-netns moves as no-ops, and make teardown moves detach from the exiting namespace even if fallback naming fails. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-3-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Pass the net namespace to the device name lookupsJiri Pirko
Prepare for per-netns RDMA device names by passing the target net namespace through the name lookup and allocation helpers. Keep current global uniqueness behaviour. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-2-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-25Input: inexio - replace printk with dev_dbg and fix missing spaceBivash Kumar Singh
Replace printk(KERN_DEBUG) with dev_dbg() using the serio device, which is the correct logging style for driver code. Also fix missing space after comma in the function argument, and remove the redundant 'inexio.c:' filename prefix from the message. Signed-off-by: Bivash Kumar Singh <bivashraj750@gmail.com> Link: https://patch.msgid.link/20260725130803.6763-1-bivashraj750@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-25Input: elo - fix coding style issues in elo_setup_10()Bivash Kumar Singh
Fix two checkpatch warnings in elo_setup_10(): - Add missing space around '-' operator in array index expression - Add missing 'const' qualifier to elo_types pointer array, since the array is never modified after initialization Signed-off-by: Bivash Kumar Singh <bivashraj750@gmail.com> Link: https://patch.msgid.link/20260725113638.5147-1-bivashraj750@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-26hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller deviceIvaylo Dimitrov
The OMAP SSI driver uses a synthetic HSI controller device allocated via hsi_alloc_controller(), which does not go through the normal OF/platform device initialization path. As a result, the embedded struct device does not have a DMA mask initialized by default. After recent DMA API hardening changes, dma_map_sg() and related helpers now require a valid dma_mask to be present, otherwise the driver may crash or trigger warnings when attempting DMA mapping operations. Fix this by explicitly initializing the DMA mask for the SSI controller device and setting a 32-bit DMA mask, which matches the hardware capabilities. Cc: stable@vger.kernel.org Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference") Reported-by: Merlijn Wajer <merlijn@wizzup.org> Closes: https://lore.kernel.org/linux-omap/4ed95c71-2066-6b4c-ad1b-53ef02d79d53@wizzup.org/ Signed-off-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com> Link: https://patch.msgid.link/20260724130522.706480-1-ivo.g.dimitrov.75@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-26HSI: omap_ssi: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() and devm_request_threaded_irq() automatically log detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Link: https://patch.msgid.link/20260713132747.394970-3-panchuang@vivo.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-26HSI: nokia-modem: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Link: https://patch.msgid.link/20260713132747.394970-2-panchuang@vivo.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-26hsi: omap_ssi: remove debugfs on port creation failurePengpeng Hou
ssi_probe() creates the controller debugfs tree before creating the SSI port child devices. If a port device cannot be created, the error path removes any children and tears down the controller, but leaves the debugfs tree behind. Remove the controller debugfs tree on the port creation failure path, matching the normal remove path. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260616004348.97684-1-pengpeng@iscas.ac.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-11 19:42:42 +0000