summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-07-06drm/ssd130x: fix column and row end address in partial updates in ssd133xAmit Barzilai
On partial screen updates, SSD133X controllers expect to get the rectangle addresses as arguments of the "Set Column Address" and "Set Row Address" commands. Each command expects the start address and end address of the row/column in absolute format, however the end addresses were being sent in a relative format (relative to the start address). The relative end addresses work only when the start address is 0. In those situations, there is no value difference between relative and absolute addresses. Fixes: b4299c936d8fd ("drm/ssd130x: Add support for the SSD133x OLED controller family") Cc: stable@vger.kernel.org Signed-off-by: Amit Barzilai <amit.barzilai22@gmail.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260622122604.32500-4-amit.barzilai22@gmail.com Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2026-07-06drm/ssd130x: hoist column and row addresses out of repeated divisionAmit Barzilai
The ssd132x_update_rect had to calculate the column address twice in the same function by dividing the byte address and the segment_width. Optimize this by hoisting the result into a col variable. Renamed the "y" variable to "row" to match the change made in the x axis. Signed-off-by: Amit Barzilai <amit.barzilai22@gmail.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260622122604.32500-3-amit.barzilai22@gmail.com Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2026-07-06drm/ssd130x: fix column and row end address in partial updates for ssd132xAmit Barzilai
On partial screen updates, SSD132X controllers expect to get the rectangle addresses as arguments of the "Set Column Address" and "Set Row Address" commands. Each command expects the start address and end address of the row/column in absolute format, however the end addresses were being sent in a relative format (relative to the start address). The relative end addresses work only when the start address is 0. In those situations, there is no value difference between relative and absolute addresses. Fixes: fdd591e00a9c9 ("drm/ssd130x: Add support for the SSD132x OLED controller family") Cc: stable@vger.kernel.org Signed-off-by: Amit Barzilai <amit.barzilai22@gmail.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260622122604.32500-2-amit.barzilai22@gmail.com Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2026-07-06qede: fix off-by-one in BD ring consumption on build_skb failureShigeru Yoshida
qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(). When it returns NULL under memory pressure, the functions still consume a BD from the ring before returning NULL. The callers then recycle additional BDs, resulting in one extra BD being consumed (off-by-one). This desynchronizes the BD ring, which can corrupt DMA page reference counts and lead to SLUB freelist corruption. Commit 4e910dbe3650 ("qede: confirm skb is allocated before using") added a NULL check inside qede_build_skb() to prevent a NULL pointer dereference, but did not address the missing NULL checks in the callers, making this off-by-one reachable. Fix this by adding NULL checks for the return value of qede_build_skb() in both qede_rx_build_skb() and qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring manipulation. Fixes: 8a8633978b84 ("qede: Add build_skb() support.") Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> Reviewed-by: Jamie Bainbridge <jamie.bainbridge@gmail.com> Link: https://patch.msgid.link/20260630164623.3152625-1-syoshida@redhat.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-06gpios: palmas: add .get_direction() opAndreas Kemnade
Accessing debug/gpio is quite noisy without a get_direction() implementation. To calm that down add an implementation. Fixes: 3d50a2785271 ("gpio: palmas: Add support for Palmas GPIO") Cc: stable@vger.kernel.org Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Link: https://patch.msgid.link/20260704-palmas-getdirection-v2-1-2fd85fee3832@kemnade.info Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-06amt: no longer rely on RTNL in amt_fill_info()Eric Dumazet
Update amt_fill_info() to run under RCU read lock instead of RTNL. The AMT device configuration fields (mode, relay_port, gw_port, local_ip, discovery_ip, max_tunnels) and stream_dev pointer are initialized during device creation (amt_newlink) and are immutable. Accessing them locklessly is safe. The stream_dev net_device structure is protected from being freed by RCU. The only field that can change concurrently is amt->remote_ip, which is updated in the packet receive path (amt_advertisement_handler) and workqueue (amt_req_work). Add READ_ONCE()/WRITE_ONCE() annotations around amt->remote_ip to prevent data races. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260701125016.3650708-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-06net: hns3: add support to query/set TX pfc_prevention_tout for ethtool with ↵Hao Chen
RX prevention disabled Add ethtool support to query and configure the PFC (Priority Flow Control) storm prevention timeout. When TX continuously sends PFC frames, the peer end is suppressed from sending packets. If this persists, a PFC frame storm may occur. This feature allows configuring a timeout to prevent such storms. Signed-off-by: Hao Chen <chenhao418@huawei.com> Signed-off-by: Jijie Shao <shaojijie@huawei.com> Link: https://patch.msgid.link/20260630134043.1532431-1-shaojijie@huawei.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-06gpio: sifive: add missing MODULE_DEVICE_TABLE()Pengpeng Hou
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260704122230.75964-1-pengpeng@iscas.ac.cn Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-06gpio: rcar: Drop unused FILONOFF macroMarek Vasut
The FILONOFF macro is never used in the driver, drop it. No functional change. Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Link: https://patch.msgid.link/20260704151055.211082-1-marek.vasut+renesas@mailbox.org Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-06gpio: cdev: Drop redundant nonseekable_open() return checkbui duc phuc
nonseekable_open() never fails, so the error check is unnecessary. Remove the dead error handling path. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260703020947.8010-1-phucduc.bui@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-06RDMA/bng_re: return a timeout when firmware responses stallPengpeng Hou
__wait_for_resp() documents that it returns a non-zero error when a firmware command does not complete, and bng_re_rcfw_send_message() already marks the firmware as stalled when the helper returns -ENODEV. However, the helper ignores wait_event_timeout() expiry. If the response slot remains in use after the timeout and after the polled CREQ service attempt, the loop starts another full timeout period and can repeat forever. Return -ENODEV after a timed out wait that still has no response. The existing caller then marks FIRMWARE_STALL_DETECTED and returns -ETIMEDOUT to the command issuer. Fixes: 53c6ee7d7f68 ("RDMA/bng_re: Enable Firmware channel and query device attributes") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260625003614.27515-1-pengpeng@iscas.ac.cn Reviewed-by: Siva Reddy Kallam <siva.kallam@broadcom.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-06gpio: mt7621: unify naming style in driver codeSergio Paracuellos
There is a mix of 'mediatek' and 'mt7621' mix of prefix in different function names along the code of the driver. Be consistent using 'mt7621' for all function prefixes. Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com> Link: https://patch.msgid.link/20260626060112.2498324-5-sergio.paracuellos@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-06Merge tag 'v7.2-rc2' of ↵Bartosz Golaszewski
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-next Linux 7.2-rc2
2026-07-06platform/x86: uniwill-laptop: Add support for the AiStone X4SP4NALArmin Wolf
A user has reported that the driver works on the AiStone X4SP4NAL. Add the necessary device descriptor and DMI entry to allow the driver to automatically load on this device. Reported-by: Michael Seifert <m.seifert@digitalernachschub.de> Closes: https://github.com/Wer-Wolf/uniwill-laptop/pull/10 Tested-by: Michael Seifert <m.seifert@digitalernachschub.de> Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260530170813.10166-7-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-07-06platform/x86: uniwill-laptop: Add support for the MACHENIKE L16 ProArmin Wolf
A user has reported that the driver works on the MACHENIKE L16 Pro. Add the necessary device descriptor and DMI entry to allow the driver to automatically load on this device. Reported-by: zatrit <zatrit@gmail.com> Closes: https://github.com/Wer-Wolf/uniwill-laptop/pull/11 Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260530170813.10166-6-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-07-06platform/x86: uniwill-laptop: Add support for USB powershareArmin Wolf
Some devices support a "USB powershare" feature where the system will continue to provide power via the USB ports when hibernating or powered off. Add support for this feaure. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260530170813.10166-5-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-07-06platform/x86: uniwill-laptop: Add AC auto boot supportArmin Wolf
Some devices support a "AC auto boot" feature where the system will automatically boot when being connected to a power source. Add support for this feature. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260530170813.10166-4-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-07-06platform/x86: uniwill-laptop: Handle screen-related eventsArmin Wolf
The EC will report event 0xCC on some devices when the screen has been enabled/disabled during resume/suspend. Ignore this event because it is currently unused by the driver. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260530170813.10166-3-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-07-06platform/x86: uniwill-laptop: Add keyboard backlight supportArmin Wolf
Many Uniwill-based devices support either a white-only or fully features RGB keyboard backlight. Add support for this feature and handle the associated WMI events. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260530170813.10166-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-07-06platform/x86: msi-ec: Add MSI Raider A18 HX A9WJG EC firmwareDavid Glushkov
Add support for EC firmware 182LIMS1.111, found on the MSI Raider A18 HX A9WJG. The out-of-tree msi-ec driver probes successfully on this machine and exports the msi-ec platform device. Without this entry, the in-tree driver rejects the EC firmware as unsupported. Tested on MSI Raider A18 HX A9WJG with BIOS E182LAMS.31A. Signed-off-by: David Glushkov <david.glushkov@sntiq.com> Link: https://patch.msgid.link/20260528183358.552782-1-david.glushkov@sntiq.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-07-06platform/x86: asus-armoury: gate PPT writes behind active fan curveAhmed Yaseen
On models flagged with requires_fan_curve in the DMI power_data table (30 entries), the BIOS ACPI method SPLX only writes PPT values to the EC when the fan mode is set to Manual (FANM=4). FANM is set to 4 by the DEFC method when a custom fan curve is written. Without an active custom fan curve, the WMI DEVS call returns success but the firmware silently ignores the PPT value, so userspace observes no effect from its write. Gate writes to ASUS_WMI_DEVID_PPT_{PL1_SPL,PL2_SPPT,PL3_FPPT,APU_SPPT, PLAT_SPPT} on a check of asus_wmi_custom_fan_curve_is_enabled(), and return -EBUSY with a pr_warn_once() when no fan curve is active on an affected model. Export the helper from asus-wmi so asus-armoury can call it across module boundaries. Signed-off-by: Ahmed Yaseen <yaseen@ghoul.dev> Reviewed-by: Denis Benato <denis.benato@linux.dev> Link: https://patch.msgid.link/20260519181155.46044-2-yaseen@ghoul.dev Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-07-06wifi: rt2x00: avoid full teardown before work setup in probeRunyu Xiao
rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for all probe failures. However, drv_data allocation and workqueue allocation can fail before intf_work, autowakeup_work and sleep_work have been initialized. Do not enter the full remove path until the probe has reached the point where those work items are set up. Return directly for drv_data allocation failure, and use a small early cleanup path for workqueue allocation failure. This issue was found by our static analysis tool and then confirmed by manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The early probe exits should not call a common teardown path that assumes the later work setup has already completed. A QEMU PoC forced alloc_ordered_workqueue() to fail before the work initializers are reached. The resulting fail path entered rt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with rt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack. Fixes: 1ebbc48520a0 ("rt2x00: Introduce concept of driver data in struct rt2x00_dev.") Fixes: 0439f5367c8d ("rt2x00: Move TX/RX work into dedicated workqueue") Cc: stable@vger.kernel.org Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn> Link: https://patch.msgid.link/20260619073104.1809161-1-runyu.xiao@seu.edu.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-06wifi: mwifiex: fix permanently busy scans after multiple roam iterationsRafael Beims
In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENT_SLEEP -> adapter->ps_state = PS_STATE_PRE_SLEEP -> sleep-confirm -> SLEEP -> EVENT_AWAKE -> AWAKE. Before sending the sleep-confirm command, the driver must make sure there are no commands either running or waiting to be completed. mwifiex_ret_802_11_associate() unconditionally sets ps_state = PS_STATE_AWAKE when it processes the association command response, outside of the normal powersave management flow. If EVENT_SLEEP arrives while the association command is in flight, ps_state is PRE_SLEEP when the association command response is parsed, and the forced AWAKE overwrites it. The deferred sleep-confirm is never sent. A subsequent scan_start command is correctly acknowledged, but the firmware doesn't generate scan_result events. The scan request never finishes, and additional requests from userspace fail with -EBUSY. After testing on both IW412 and W8997, I could only trigger the bug on the IW412 and observed the firmwares behave differently. On the IW412 the firmware still sends EVENT_SLEEP while the authentication / association process is ongoing. A W8997 under the same conditions seems to suppress power-save for the duration of the association, so PRE_SLEEP never coincided with the association response even after extended periods of testing using the loops described below (>12hours). On the IW412, the delay between commands that triggers an EVENT_SLEEP was empirically determined to be ~20ms. This delay can naturally occur when the driver is outputting debugging information (debug_mask = 0x00000037), in which situation the busy scans issue is repeatable while running "test 1)" as described below. If the delay between commands is less than ~20ms, the firmware stays awake and the issue was not reproducible running the same test. The host_mlme=false path also behaves differently. In this case, the entire authentication / association transaction is executed by one command (HostCmd_CMD_802_11_ASSOCIATE), and the firmware doesn't emit EVENT_SLEEP while the command is running. Remove the assignment so the ps_state is only manipulated in the paths that are related to powersave event handling and on the main workqueue for correct sleep confirmation. The following loop tests were performed (with debugging output enabled): 1) force roaming between two AP's, one 5GHz and one 2.4GHz, same SSID. Use wpa_cli to trigger the roaming behavior, sleep 2s between iterations. 2) force a disconnection to AP 1 and a connection to AP 2, test scan. Use wpa_cli to trigger the connection changes, sleep 2s between iterations. Each test ran in each device for at least 3 hours. Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Rafael Beims <rafael.beims@toradex.com> Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com> Link: https://patch.msgid.link/20260612122547.1586872-2-rafael@beims.me Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-06wifi: mwifiex: fix roaming to different channel in host_mlme modeRafael Beims
When host MLME is enabled, mwifiex_cfg80211_authenticate() transmits the authentication frame on a remain-on-channel (ROC) reservation so that the frame is sent on the target BSS's channel. The ROC is only configured when priv->auth_flag is zero. priv->auth_flag is set to HOST_MLME_AUTH_PENDING when the auth frame is queued and advances to HOST_MLME_AUTH_DONE once authentication completes. It is only cleared back to zero on a disconnect, deauth or timeout path; nothing clears it when an association succeeds. It therefore stays at HOST_MLME_AUTH_DONE for the whole connected session. When the station later roams to a BSS on a different channel, the next authentication finds auth_flag != 0, skips the ROC setup, and the auth frame is transmitted on the currently-associated channel instead of the target's channel. Authentication times out on the new AP and the device stays connected to the original AP. Gate the ROC setup on HOST_MLME_AUTH_PENDING instead of on auth_flag being completely clear. This re-arms the remain-on-channel for every new authentication attempt, while still suppressing a redundant ROC during the multi-frame SAE exchange, where auth_flag stays PENDING between the commit and confirm frames. This change was tested in 3 different devices: Verdin AM62 (IW412 SD-UART) - (16.92.21.p142) Verdin iMX8MM (W8997 SD-SD) - (16.68.1.p197) Verdin iMX8MP (W8997 SD-UART) - (16.92.21.p137) There following loop tests were performed: 1) force roaming between two AP's, one 5GHz and one 2.4GHz, same SSID. Use wpa_cli to trigger the roaming behavior, sleep 2s between iterations. 2) force a disconnection to AP 1 and a connection to AP 2, test scan. Use wpa_cli to trigger the connection changes, sleep 2s between iterations. Each test ran in each device for at least 3 hours. Fixes: 36995892c271 ("wifi: mwifiex: add host mlme for client mode") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Rafael Beims <rafael.beims@toradex.com> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/20260610150021.1018611-1-rafael@beims.me Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-06Merge tag 'drm-misc-next-2026-06-19' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for 7.3: UAPI Changes: - connector: Add color format property Cross-subsystem Changes: - dmem: introduce a peak file Core Changes: - atomic: Add create_state callback and helpers to all objects, add documentation on atomic commit lifetime - buddy: Fix use-after-free, add per-order free and used block scoreboards - gem: Remove DRIVER_GEM_GPUVA feature flag - hdmi: Hook the color format property in the helpers - mipi-dsi: Add MIPI_DSI_MODE_DSC_ALL_SLICES_IN_PKT flag - sched: Add test suite for concurrent job submissions - virtio: Add support for saving and restoring virtio_gpu_objects, abort virtqueue wait on device removal to avoid hung task Driver Changes: - amdgpu: Implement "color format" DRM property - amdxdna: Disable device buffer exporting - ethosu: Add performance counter support - msm: Support DSC configurations with slice_per_pkt > 1 - mxsfb: Fix disable sequence - panthor: Support sparse mappings - rockchip: Support YUV background color, Fix layer config timeout, add edp support for rk3576, cleanups and formats improvements - solomon: Add a batch command submission function - tegra: Add DSI support for Tegra 20 and 30, fix dsi driver when the firmware hasn't enabled the controller, - v3d: Reduce PM runtime autosuspend delay, Scheduler and submission fixes and refactoring, Deprecate V3D 3.3 and 4.1 support - bridge: - display-connector: don't autoenable HPD IRQ, trigger initial HPD event for DP - dw-dp: Null pointer dereference and use-after-free fixes - ti-sn65dsi83: Remove NO_HFP and NO_HBP mode flags - panel: - himax-hx83121a: add backlight regulator support - novatek-nt36672a: Inline panel init sequences - panel-edp: Add quirks for AUO B116XAT04.3, CMN N116BCP-EA2, CSW MNB601LS1-8, BOE NV116WH2-M30, BOE NT116WHM-N21, BOE NV116FH1-M31, BOE NV116FH1-M30, NV140FHM-N5B, TM156VDXP25 - New panels: Samsung ATNA40HQ08-0, Anbernic TD4310, Chipone ICNA35XX, Ilitek ILI9488 Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@redhat.com> Link: https://patch.msgid.link/20260619-burgundy-termite-of-whirlwind-f7a4dd@houat
2026-07-06RDMA/hfi1: Remove unused non-user-accessible device classMichal Schmidt
The driver defines two device classes: "hfi1" (mode 0600) and "hfi1_user" (mode 0666), selected by a user_accessible parameter to hfi1_cdev_init(). The only caller always passes user_accessible=true, so the "hfi1" class is registered but never used. The 0600 class was originally used by the diagnostics UI char device (hfi1_ui*), but that was removed over 10 years ago in commit 7312f29d8ee5 ("IB/hfi1: Remove UI char device"). The class and the user_accessible parameter were left behind. Remove the unused class and the user_accessible parameter. Now that there's only one class, it might make sense to change its name from "hfi1_user" to just "hfi1", but not knowing whether userspace would mind, keep the name as is. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Link: https://patch.msgid.link/20260701150510.384858-1-mschmidt@redhat.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-06drm/i915/psr: Block DC3CO entry during active frameDibin Moolakadan Subrahmanian
On Xe3P, when PSR2 is enabled on a panel that does not support Early Transport, DC3CO can be entered in the middle of an active frame. This prevents the pipe from completing the frame and leaves it in a bad state that does not recover well, causing visible corruption on screen. Set CHICKEN_DCPR_4 bit 24 in the PSR2 enable path when Early Transport is not in use, to notify DMC to prevent DC3CO entry. v2: - Remove display from commit header (Suraj Kandpal). - Add HSD number to intel_display_wa framework (Suraj Kandpal). - Change register prefix from XE3LPD_ to XE3P_ (Suraj Kandpal). BSpec: 71483, 75253 Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260701100650.1689665-2-dibin.moolakadan.subrahmanian@intel.com
2026-07-06rust: rcpufreq_dt: use vertical import styleGuru Das Srinagesh
Convert `use` imports to vertical layout for better readability and maintainability. Signed-off-by: Guru Das Srinagesh <linux@gurudas.dev> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-07-06ata: libata-scsi: scale DSM TRIM payload by MAX PAGES PER DSM COMMANDNiklas Cassel
DSM TRIM currently always emits a single 512-byte page of LBA Range Entries (ATA_MAX_TRIM_RNUM == 64 ranges), regardless of how many pages the device can accept in one DATA SET MANAGEMENT command. The maximum is reported by MAX PAGES PER DSM COMMAND (IDENTIFY DEVICE word 105). Honour it: size the TRIM descriptor as a whole number of 512-byte pages, bounded by that limit and by the logical sector size (the WRITE SAME data-out buffer is a single logical block). Build and transfer only as many pages as the request needs, and set the DSM COUNT field, qc->nbytes and the maximum WRITE SAME length in the Block Limits VPD page accordingly. Build the descriptor straight into the WRITE SAME data-out buffer using an atomic sg_miter mapping, instead of staging it in the shared ata_scsi_rbuf and copying it out. This removes the global ata_scsi_rbuf_lock and a memcpy from the TRIM path. While commit 9379e6b8e0f9 ("libata: Safely overwrite attached page in WRITE SAME xlat") replaced direct access to the data-out buffer with an intermediate step that writes the entries in the ata_scsi_rbuf buffer, this solution writes to the data-out buffer using sg_miter, which maps each segment with kmap_atomic (SG_MITER_ATOMIC), so it's highmem- and multi-segment-safe, and it's usable from the non-sleeping command-submission path (unlike the page_address() access that ata_scsi_rbuf originally replaced). A 512-byte-sector device still uses a single page, so its behaviour is unchanged. Add ata_id_dsm_max_pages() to read IDENTIFY DEVICE word 105. Reviewed-by: Hannes Reinecke <hare@kernel.org> Signed-off-by: Niklas Cassel <cassel@kernel.org> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-06ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytesNiklas Cassel
ata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is built by ata_format_dsm_trim_descr() into the 2048-byte ata_scsi_rbuf staging buffer, and the number of bytes copied is compared against the logical sector size by the caller: size = ata_format_dsm_trim_descr(scmd, trmax, block, n_block); if (size != len) /* len == sdp->sector_size */ goto invalid_param_len; ata_format_dsm_trim_descr() clamps the copy length to ATA_SCSI_RBUF_SIZE (2048). On a device whose logical sector size exceeds that (e.g. a 4Kn device, where sector_size == 4096) the function can never return more than 2048, while the caller expects it to return sector_size. The comparison therefore always fails, so every TRIM is rejected with "Parameter list length error" and WARN_ON() splats on each attempt. TRIM / discard is thus completely broken on such devices. The descriptor was incorrectly sized from the logical sector size. A DSM TRIM payload is a list of 512-byte pages, each holding up to ATA_MAX_TRIM_RNUM (64) LBA Range Entries, and is independent of the logical sector size. The Block Limits VPD page already advertises a single such page as the maximum WRITE SAME length (65535 * ATA_MAX_TRIM_RNUM logical blocks), so the block layer never sends a request that needs more than one page. Emit exactly one 512-byte page, independent of the logical sector size, and transfer only that page (COUNT == 1). For a 512-byte-sector device this is unchanged; devices with larger logical sectors now work instead of failing every TRIM. Reviewed-by: Hannes Reinecke <hare@kernel.org> Fixes: ef2d7392c4ec ("libata: SCT Write Same / DSM Trim") Cc: stable@vger.kernel.org Signed-off-by: Niklas Cassel <cassel@kernel.org> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-06ata: libata-scsi: support the all command format for reporting supported ↵Damien Le Moal
commands Add support to ata_scsi_report_supported_opcodes() for the all command format indicated with a reporting option of 0. The function ata_scsi_report_all_supported_opcodes() is introduced to implement this support. This function operates by testing all commands of the ata_supported_cmds array and testing them using ata_scsi_cmd_is_supported(), filling rbuf as it loops through all the commands that libata can emulate or translate. With this change, sg_opcodes /dev/sdX is able to list all commands supported by libata and a device. An example below is shown for a SATA disk also supporting CDL: # sg_opcodes /dev/sda ATA WDC WUH722626AL WZ41 Peripheral device type: disk Opcode Service CDB RWCDLP, Name (hex) action(h) size CDLP ----------------------------------------------- 00 6 0,0 Test Unit Ready 01 6 0,0 Rezero Unit 03 6 0,0 Request Sense 08 6 0,0 Read(6) 0a 6 0,0 Write(6) 0b 6 0,0 Seek(6) 12 6 0,0 Inquiry 15 6 0,0 Mode select(6) 1a 6 0,0 Mode sense(6) 1b 6 0,0 Start stop unit 1d 6 0,0 Send diagnostic 25 10 0,0 Read capacity(10) 28 10 0,0 Read(10) 2a 10 0,0 Write(10) 2b 10 0,0 Seek(10) 2f 10 0,0 Verify(10) 35 10 0,0 Synchronize cache(10) 55 10 0,0 Mode select(10) 5a 10 0,0 Mode sense(10) 7f 1ff0 32 0,0 ATA pass-through(32) 85 16 0,0 ATA pass-through(16) 88 16 1,1 Read(16) 8a 16 1,2 Write(16) 8f 16 0,0 Verify(16) 91 16 0,0 Synchronize cache(16) 9e 10 16 0,0 Read capacity(16) a0 12 0,0 Report luns a1 12 0,0 ATA pass-through(12) a3 c 12 0,0 Report supported operation codes Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-06ata: libata-scsi: support reporting options 2 in REPORT SUPPORTED OPERATION ↵Damien Le Moal
CODES Add support for the reporting options value 2 of the in REPORT SUPPORTED OPERATION CODES command in ata_scsi_report_supported_opcodes(). With this reporting option, the specified opcode to check must have a service action. Use ata_scsi_supported_cmd_has_sa() to check for this and fill the command reply buffer using the one command format based on the command support. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-06ata: libata-scsi: improve service action support in ↵Damien Le Moal
ata_scsi_report_supported_opcodes() ata_scsi_report_supported_opcodes() is ignoring the service action specified in the SCSI command CDB, but the one command format must take this field into consideration. With the reporting options field set to 1, the REPORT SUPPORTED OPERATION CODES command must be failed if the specified opcode to check has service actions, while reporting option 3 must match supported opcodes together with the specified service action. Stop ignoring the service action by passing it to ata_scsi_cmd_is_supported() and searching for commands in the array of supported commands (ata_supported_cmds) using both the command opcode and service action. Introduce the helper function ata_scsi_supported_cmd_use_sa() to determine if a particular command has service actions and use this function to fail a REPORT SUPPORTED OPERATION CODES command if such command is specified with reporting options 1. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-06ata: libata-scsi: refactor ata_scsi_report_supported_opcodes()Damien Le Moal
ata_scsi_report_supported_opcodes() is very limited in functionality as it lacks support for the all command format and also does not handle correctly commands that have a service action. In preparation for adding these missing features, refactor how ata_scsi_report_supported_opcodes() operates to make modifications and extensions easier. To do so, introduce the array of supported commands ata_supported_cmds. This array entries are of type struct ata_scsi_cmd. This structure stores the operation code, CDB length, and the service action of a supported SCSI command that libata SAT can translate or emulate. Since some service actions (e.g. ZI_REPORT_ZONES) can have a value of 0, the field sa_valid of struct ata_scsi_cmd is used to indicate if the sa field is valid, or if it should be ignored. The helper function ata_scsi_get_supported_cmd() is implemented to search for a particular command by opcode in this array. This function is used in ata_scsi_cmd_is_supported() together with a struct ata_scsi_cmd_support to check based on the target device features if the specified command is supported. ata_scsi_cmd_is_supported() is used as the main function in ata_scsi_report_supported_opcodes() to determine if a particular command is supported and fill the command reply rbuf as needed. In the case of a command that is not supported, the support field is set to 1 as specified in SPC, indicating that the command is not supported. Of note is that the old ata_scsi_report_supported_opcodes() code did not handle the VARIABLE_LENGTH_CMD/ATA_32 command which is supported and translated by libata-scsi. The ata_supported_cmds array includes this command. As commented in the code, WRITE_SAME_16 is left out of the array of supported command ata_scsi_write_same_xlat() prevents the use of this command as a passthrough command. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-06ata: libata: rename ata_dev_is_zac()Damien Le Moal
The helper function ata_dev_is_zac() checks if a device is a ZAC class device (host managed zoned disk) or if it is a host aware zoned disk, that is, a regular ATA disk that supports the zoned capabilities. So the name of this helper function is confusing as it hints at the first case only. Rename this helper function to ata_dev_is_zoned() to avoid confusions and better reflect the two cases tested. Use this helper in ata_scsiop_inq_std(), ata_scsiop_read_cap() and ata_scsi_report_supported_opcodes() instead of having the same tests open coded. While at it, to stay consistent with this renaming, also rename ata_dev_config_zac() to ata_dev_config_zoned(). Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-05ipmi:si: Add async init to ipmi_siMichal Clapinski
Added a new config option to allow offloading individual calls to try_smi_init(). Saves 100ms on my system. Signed-off-by: Michal Clapinski <mclapinski@google.com> Message-ID: <20260703150955.3943082-1-mclapinski@google.com> Signed-off-by: Corey Minyard <corey@minyard.net>
2026-07-06iio: adc: ade9000: Drop incorrect kerneldoc markerKrzysztof Kozlowski
Top-level comment is not a kerneldoc, so drop marker to fix W=1 warning: drivers/iio/adc/ade9000.c:2 This comment starts with '/**', but isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Maxwell Doose <m32285159@gmail.com> Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-05soc: qcom: ubwc: Add config for MilosLuca Weiss
Describe the Universal Bandwidth Compression (UBWC) configuration for the Milos SoC. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Luca Weiss <luca.weiss@fairphone.com> Link: https://lore.kernel.org/r/20260501-milos-mdss-v3-5-58bfc58c0e13@fairphone.com [bjorn: Rebased on recent refactorings] Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-05soc: qcom: ubwc: deduplicate UBWC configuration dataDmitry Baryshkov
After removing all extra entries from the UBWC database it is easy to define generic entries, common for all machine classes. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260520-ubwc-rework-v5-28-72f2749bc807@oss.qualcomm.com [bjorn: Dropped unused "ubwc_3_0_hbb16", per compiler warning] Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-05soc: qcom: ubwc: sort out the rest of the UBWC swizzle settingsDmitry Baryshkov
Sort out the remaining UBWC swizzle values, using flags to control whether level 2 and level 3 swizzling are enabled or not. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260520-ubwc-rework-v5-27-72f2749bc807@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-05soc: qcom: ubwc: use fixed values for UBWC swizzle for UBWC < 4.0Dmitry Baryshkov
UBWC devices before 4.0 use standard UBWC swizzle levels. As all the drivers now use the qcom_ubwc_swizzle() helper, move those values to the helper, leaving UBWC 4.0+ intact for now. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260520-ubwc-rework-v5-26-72f2749bc807@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-05soc: qcom: ubwc: drop macrotile_mode from the databaseDmitry Baryshkov
All the users have been migrated to using qcom_ubwc_macrotile_mode() instead of reading the raw value from the config structure. Drop the field from struct qcom_ubwc_cfg_data and replace it with the calculated value. Split single UBWC_3_0 into UBWC_3_0 (no macrotile mode) and UBWC_3_1 (with macrotile mode). Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260520-ubwc-rework-v5-25-72f2749bc807@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-05soc: qcom: ubwc: drop ubwc_bank_spreadDmitry Baryshkov
According to the documentation, UBWC bank spreading should be enabled for all targets. It's just not all targets have separate bit to control it. Drop the bit from the database and make the helper always return true. If we need to change it later, the helper can be adjusted according to the programming guides. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260520-ubwc-rework-v5-24-72f2749bc807@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-05soc: qcom: ubwc: drop ubwc_dec_versionDmitry Baryshkov
The ubwc_dec_version field has been inherited from the MDSS driver and it is equal to the version of the UBWC decoder in the display block only. Other IP Cores can have different UBWC decoders and so the version would vary between blocks. As the value is no longer used as is not relevant to other UBWC database consumers, drop it from the UBWC database. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260520-ubwc-rework-v5-23-72f2749bc807@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-05soc: qcom: cmd-db: use C-style SPDX comment for source fileMayur Kumar
checkpatch.pl reports an improper SPDX comment style for this file: WARNING: Improper SPDX comment style for 'drivers/soc/qcom/cmd-db.c', please use '//' instead Per Documentation/process/license-rules.rst, C source files must use the '// SPDX-License-Identifier: ...' form instead of the '/* ... */' form. Fix it. Signed-off-by: Mayur Kumar <kmayur809@gmail.com> Reviewed-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260510193840.59156-1-kmayur809@gmail.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-05soc: qcom: socinfo: Add SoC ID for SDM850David Heidelberg
Recognize the SDM850 SoC. Signed-off-by: David Heidelberg <david@ixit.cz> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260627-sda850-v2-2-44bf46ade42e@ixit.cz Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-05Merge tag 'irq-urgent-2026-07-05' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Ingo Molnar: "Misc irqchip driver fixes: - Fix a resource leak in the RISC-V imsic-early driver (Haoxiang Li) - Fix an OF node reference leak in the ARM gic-v3-its driver (Yuho Choi) - Fix a dangling handler function on module removal bug in the TS-4800 ARM board irqchip driver (Qingshuang Fu)" * tag 'irq-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/ts4800: Fix missing chained handler cleanup on remove irqchip/gic-v3-its: Fix OF node reference leak irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
2026-07-05Merge tag 'spi-fix-v7.2-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small set of fixes that came in since -rc1, we have one core fix for shutting down target mode properly if the system suspends while it's running plus a small set of fairly unremarkable device specific fixes. There's also a couple of pure DT binding changes for Renesas SoCs, the power domains one allows some SoCs to be correctly described with existing code" * tag 'spi-fix-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: rzv2h-rspi: Fix DMA transfer error handling for signal interruption spi: dt-bindings: snps,dw-apb-ssi: add 'power-domains' property spi: dt-bindings: snps,dw-apb-ssi: drop superfluous RZ/N1 entry spi: dw: use the correct error msg if request_irq() fails spi: dw: fix first spi transfer with dma always fallback to PIO spi: core: Abort active target transfer on controller suspend spi: sh-msiof: abort transfers when reset times out
2026-07-05pwm: pxa: Depend on OF and simplify accordinglyUwe Kleine-König (The Capable Hub)
The SoCs that this driver actually works on all imply OF already. (ARM selects USE_OF unless some archs are enabled that cannot be selected together with ARCH_PXA or ARCH_MMP, ARM64 and RISCV select OF.) With OF known to be enabled a few conditionals in the driver can be simplified. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20260705083910.3502207-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-07-05soc: apple: sart: require device link for consumersPengpeng Hou
devm_apple_sart_get() obtains the supplier platform device and attempts to create a runtime-PM device link to it, but it ignores device_link_add() failure. A consumer can then continue without the dependency that keeps the SART supplier ordered and runtime-PM reachable. Treat a failed device link as an error and drop the supplier device reference before returning. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: Joshua Peisach <jpeisach@ubuntu.com> Link: https://patch.msgid.link/20260616005346.7862-1-pengpeng@iscas.ac.cn Signed-off-by: Sven Peter <sven@kernel.org>