summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-15bpf: Unify helper and kfunc allocation-size argument handlingAmery Hung
The constant "size of the PTR_TO_MEM returned in R0" argument is handled by both helpers (ARG_CONST_ALLOC_SIZE_OR_ZERO) and kfuncs (__rdonly_buf_size / __rdwr_buf_size), each with its own meta field (meta->mem_size, meta->r0_size) and duplicated validation. Add struct arg_alloc_mem_desc and a shared process_const_alloc_mem_size(), and replace both fields with meta->arg_alloc_mem. The desc records presence with a 'found' flag instead of using a non-zero size as the sentinel. This also fixes a pre-existing bug on the kfunc return path: "no size argument" was tested as r0_size == 0, so an explicit __rdonly_buf_size/__rdwr_buf_size of 0 was treated as absent and fell through to btf_resolve_size(), giving R0 the size of the pointed-to return type instead of 0. With 'found', an explicit zero size is honored and btf_resolve_size() is used only when no size argument was passed. The size is stored in a u32, matching regs[R0].mem_size. The U32_MAX check now apply to both helper and kfunc through process_const_alloc_mem_size(). Fold bpf_session_cookie return size assignment into current kfunc return size resolution path. Note that verifier saves kfunc return size through r0_size instead of mem_size. The later has no active readers so remove it. Signed-off-by: Amery Hung <ameryhung@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260715064047.1793790-5-ameryhung@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-15bpf: Pass argno to callees in check_func_arg() instead of argno_from_reg(regno)Amery Hung
check_func_arg() only ever handles register arguments (the caller loops over the first MAX_BPF_FUNC_REG_ARGS arguments), so a single argno_t built from the register number identifies the argument for every callee. Remove the duplicated argno_from_reg() calls to simplify check_func_arg(). 'regno' is still kept for the few places that need the raw register number directly (register reads, verbose R%d messages) and for referring to the neighbouring size/memory argument in the ARG_CONST_SIZE{,_OR_ZERO} cases. No functional change intended. Suggested-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Amery Hung <ameryhung@gmail.com> Link: https://lore.kernel.org/bpf/20260715064047.1793790-4-ameryhung@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-15bpf: Factor out raw_mode-related fields in bpf_call_arg_metaAmery Hung
To prepare for unifying the helper and kfunc call_arg_meta, group the scattered MEM_UNINIT ("raw") memory argument fields (raw_mode, regno and access_size) into a new struct arg_raw_mem_desc. The intention is to make it clear about when these are set and used instead of fields with overly generic names. Identify the raw argument once, up front, in check_raw_mode_ok() (like check_proto_release_reg() does for release_regno), recording its regno. check_stack_range_initialized() now recognizes the raw buffer by matching that regno, so the separate raw_mode flag is no longer needed, and the per-argument "meta->raw_mode = arg_type & MEM_UNINIT" assignments in check_func_arg() go away with it. A raw memory argument can be tagged either ARG_PTR_TO_MEM | MEM_UNINIT or ARG_PTR_TO_MAP_VALUE | MEM_UNINIT (the output buffer of bpf_map_pop_elem() and bpf_map_peek_elem()). Either may be passed as a PTR_TO_STACK, which reaches check_stack_range_initialized() through check_helper_mem_access(), so both must be treated as raw. Extend arg_type_is_raw_mem() to match the map value case as well; otherwise check_raw_mode_ok() would not record the regno for it and an uninitialized stack buffer passed to those helpers would be wrongly rejected for programs without CAP_PERFMON. No functional change intended. This patch does not enable raw_mode memory access for kfunc (i.e., uninit stack will not be allowed to be passed to kfunc for unprivileged programs). Existing kfuncs with arguments tagged with __uninit are either priviledged or dynptr kfuncs, which take another path to make sure the access is checked by check_mem_access(). Signed-off-by: Amery Hung <ameryhung@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260715064047.1793790-3-ameryhung@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-15bpf: Remove dynptr check in check_stack_range_initialized()Amery Hung
For a MEM_UNINIT ("raw mode") helper argument, check_stack_range_initialized() open-coded a scan that rejected any STACK_DYNPTR slot in the range with "potential write to dynptr". This duplicated, and was stricter than, the handling that runs when the buffer is actually marked initialized. check_helper_call() later replays the write byte by byte via check_mem_access(), which goes through destroy_if_dynptr_stack_slot(), which rejects overwritting a referenced dynptr. Therefore drop the redundant scan and rely on check_mem_access(). Signed-off-by: Amery Hung <ameryhung@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260715064047.1793790-2-ameryhung@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-15mmc: sdhci-esdhc-imx: fix resume error handlingLuke Wang
Check pm_runtime_force_resume() return value in resume. If it fails (clock enable failure), return immediately since accessing hardware registers on an unclocked device would cause a kernel panic. The early return intentionally skips enable_irq() and sdhci_disable_irq_wakeups() because the IRQ handler reads SDHCI_INT_STATUS, which would also fault without clocks. The PM runtime usage counter leak only affects this already-broken device instance and is an acceptable tradeoff to preserve system stability. Remove the return value check for mmc_gpio_set_cd_wake(host->mmc, false) since disable_irq_wake() called internally always returns 0. Also return 0 explicitly on the success path instead of propagating stale return values. Fixes: 676a83855614 ("mmc: host: sdhci-esdhc-imx: refactor the system PM logic") Acked-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-15mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspendLuke Wang
Make pinctrl_pm_select_sleep_state() and mmc_gpio_set_cd_wake() failures non-fatal in the suspend path. These failures only mean slightly higher power consumption or missing CD wakeup capability, but should not block system suspend. Also change the function to always return 0 on the success path instead of propagating non-fatal warning return values. Fixes: 676a83855614 ("mmc: host: sdhci-esdhc-imx: refactor the system PM logic") Acked-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-15mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspendLuke Wang
Replace pm_runtime_get_sync() with pm_runtime_resume_and_get() to simplify error handling. pm_runtime_resume_and_get() automatically drops the usage counter on failure, avoiding the need for a separate pm_runtime_put_noidle() call. If it fails, the device is unclocked and accessing hardware registers would cause a kernel panic, so return the error immediately. Fixes: 676a83855614 ("mmc: host: sdhci-esdhc-imx: refactor the system PM logic") Acked-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-15mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interruptLuke Wang
When using WIFI out-of-band wakeup, an "irq xxx: nobody cared" warning occurs. This happens because the usdhc interrupt is not disabled during system suspend when device_may_wakeup() returns false. The sequence of events leading to this issue: 1. System enters suspend without disabling usdhc interrupt (because device_may_wakeup() returns false for usdhc device) 2. WIFI out-of-band wakeup triggers system resume via GPIO interrupt 3. WIFI sends a Card interrupt before usdhc has fully resumed 4. usdhc is still in runtime suspend state and cannot handle the interrupt properly 5. The unhandled interrupt triggers "nobody cared" warning Fix this by unconditionally disabling the usdhc interrupt during suspend and re-enabling it during resume, regardless of the wakeup capability. This ensures no interrupts are processed during the suspend/resume transition. Fixes: 676a83855614 ("mmc: host: sdhci-esdhc-imx: refactor the system PM logic") Acked-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Haibo Chen <haibo.chen@nxp.com> Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-15mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resumeLuke Wang
SDIO devices such as WiFi may keep power during suspend, so the MMC core skips full card re-initialization on resume and directly restores the host controller's ios timing to match the card. For DDR mode, pm_runtime_force_resume() sets DDR_EN before the pin configuration is restored from sleep state. This is related to the SoC IP integration: switching pinctrl setting (changing alt from GPIO to USDHC) impacts the internal loopback path. If pinctrl configures the pad to GPIO function, once DDR_EN is set, the DLL delay will be fixed based on the GPIO function loopback path. When the pinctrl is later changed to USDHC function, the internal loopback path changes, making the original fixed sample point no longer suitable for the current loopback path. This causes persistent read CRC errors on subsequent data transfers. SD/eMMC running in DDR mode are unaffected as they are fully re-initialized from legacy timing after resume. Fix this by restoring the pinctrl state based on current timing mode using esdhc_change_pinstate() before pm_runtime_force_resume(). This ensures the correct pin configuration (e.g., 100/200MHz for UHS modes) is applied before DDR_EN is set. Only restore for non-wakeup devices since wakeup devices kept their active pin state during suspend. Fixes: 676a83855614 ("mmc: host: sdhci-esdhc-imx: refactor the system PM logic") Acked-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Haibo Chen <haibo.chen@nxp.com> Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-15drm/i915/bw: avoid replicating the update_sagv_status() callsVinod Govindapillai
Now that SAGV status update is consolidated, need to update the SAGV status based on the number of QGV points only once after bw info initialization is done. v2: patch description updated. Signed-off-by: Vinod Govindapillai <vinod.govindapillai@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260615203355.218578-7-vinod.govindapillai@intel.com
2026-07-15mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restoreLuke Wang
esdhc_change_pinstate() checks for pins_100mhz and pins_200mhz at the top of the function and returns -EINVAL if either is not defined. This prevents the default case from ever being reached, which means devices with a sleep pinctrl state but without high-speed pin states (100mhz/ 200mhz) can never restore their default pin configuration. Move the IS_ERR checks for pins_100mhz and pins_200mhz into their respective switch cases. Fixes: 676a83855614 ("mmc: host: sdhci-esdhc-imx: refactor the system PM logic") Acked-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-15mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resumeLuke Wang
sdhci_esdhc_imx_hwinit() unconditionally clears ESDHC_DLL_CTRL by writing zero. For SDIO devices that keep power during system suspend and operate in DDR mode, the card remains in DDR timing while the host DLL override configuration is lost. Extract the DLL override setup from esdhc_set_uhs_signaling() into a helper esdhc_set_dll_override(), and call it on the resume path when the card kept power and is using a DDR timing mode. Fixes: 676a83855614 ("mmc: host: sdhci-esdhc-imx: refactor the system PM logic") Acked-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Haibo Chen <haibo.chen@nxp.com> Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-15drm/i915/bw: extract update_sagv_status()Vinod Govindapillai
Extract the code to update the SAGV status based on the number of QGV points into a separate function and use it. v2: rebase v3: patch description updated Signed-off-by: Vinod Govindapillai <vinod.govindapillai@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260615203355.218578-6-vinod.govindapillai@intel.com
2026-07-15drm/i915/bw: Extract icl_init_qgv_info()Vinod Govindapillai
Simplify the initialization of QGV points info by extracting the code to initialize the QGV points info from dram info based on the memory type. This will reduce the complexity of the init QGV info routine as we will be supporting new memory types in future platforms. v2: rebase after Ville's refactoring v3: patch description updated Signed-off-by: Vinod Govindapillai <vinod.govindapillai@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260615203355.218578-5-vinod.govindapillai@intel.com
2026-07-15mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for ↵Luke Wang
tuning save/restore The tuning save/restore during system PM is conditioned on mmc_card_wake_sdio_irq(), but this check is unrelated to whether tuning values need to be preserved. The actual requirement is that the card keeps power during suspend and the controller is a uSDHC. SDIO devices using out-of-band GPIO wakeup maintain power during suspend but do not set the SDIO IRQ wake flag. In this case the tuning delay values are not saved/restored. Remove the unnecessary mmc_card_wake_sdio_irq() condition from both the suspend save and resume restore paths. Fixes: c63d25cdc59a ("mmc: sdhci-esdhc-imx: Save tuning value when card stays powered in suspend") Acked-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Haibo Chen <haibo.chen@nxp.com> Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-15docs: bpf: Document BPF_RB_OVERWRITE_POS in bpf_ringbuf_queryJianlin Shi
BPF_RB_OVERWRITE_POS is supported by bpf_ringbuf_query() but was missing from the helper documentation. Add it to the flags list in both the kernel UAPI header and its tools/ mirror. Signed-off-by: Jianlin Shi <shijianlin11@foxmail.com> Acked-by: Xu Kuohai <xukuohai@huawei.com> Link: https://lore.kernel.org/bpf/tencent_22134645443B75ED907D2A85A47AD554A709@qq.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-15Merge branch 'bpf-bidirectional-vlan-support-for-bpf_fib_lookup'Kumar Kartikeya Dwivedi
Avinash Duduskar says: ==================== bpf: bidirectional VLAN support for bpf_fib_lookup() This series adds VLAN awareness to bpf_fib_lookup() in both directions. BPF_FIB_LOOKUP_VLAN resolves a VLAN egress to its underlying real device plus the VLAN tag (XDP programs need this because VLAN devices have no XDP xmit), and BPF_FIB_LOOKUP_VLAN_INPUT runs the lookup as if a tagged frame had arrived on the matching VLAN subinterface, for iif policy routing and VRF table selection. BPF_FIB_LOOKUP_VLAN opts in to replacing params->ifindex, whose value existing programs consume since d1c362e1dd68 ("bpf: Always return target ifindex in bpf_fib_lookup"); without it the output is unchanged. An egress that does not reduce to a real device plus one tag (a QinQ stack, or a parent in another network namespace) returns BPF_FIB_LKUP_RET_VLAN_FAILURE with params->ifindex left at the input; repeating the lookup without the flag, with a re-initialized params, returns the VLAN device's own ifindex. A VLAN on a bond reduces to the bond, which picks its egress slave at xmit. The new return code is appended after BPF_FIB_LKUP_RET_NO_SRC_ADDR (nothing renumbered, tools/ mirror updated) and is returned only when the flag is set, so no existing caller can observe it. Changes v6 -> v7: - Patch 1 (BPF_FIB_LOOKUP_VLAN: resolve a VLAN egress to its real device plus the tag): uapi doc clarified, repeating the lookup after BPF_FIB_LKUP_RET_VLAN_FAILURE needs a re-initialized params, since output fields overwrite the inputs they share storage with. No functional change. - Patch 2 (BPF_FIB_LOOKUP_VLAN_INPUT: run the lookup as if the tagged frame arrived on the matching VLAN subinterface): no code change; a commit message correction (an invalid proto returns -EINVAL under !CONFIG_VLAN_8021Q too). - Patch 3 (selftests for both flags, tc and XDP paths): local defines for the netns subtest addresses (Emil's review); the netns input arm brings the moved device up first, so the namespace check is the only condition it can fail on; the live-frames subtest uses its own netns name (no collision under test_progs -j) and counts only the test's TCP frames, so background traffic cannot satisfy the delivery assertion; a stale mtu comment corrected. v6: https://lore.kernel.org/all/20260704092159.1256823-1-avinash.duduskar@gmail.com/ v5: https://lore.kernel.org/all/20260624030530.3342884-1-avinash.duduskar@gmail.com/ v4: https://lore.kernel.org/all/20260623025147.1001664-1-avinash.duduskar@gmail.com/ v3: https://lore.kernel.org/all/20260617224729.1428662-1-avinash.duduskar@gmail.com/ v2: https://lore.kernel.org/all/20260616223426.3568080-1-avinash.duduskar@gmail.com/ v1: https://lore.kernel.org/all/20260609172052.81613-1-avinash.duduskar@gmail.com/ ==================== Link: https://patch.msgid.link/20260713162305.1237211-1-avinash.duduskar@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-15selftests/bpf: Add bpf_fib_lookup() VLAN flag testsAvinash Duduskar
Cover both new VLAN flags in the fib_lookup test. BPF_FIB_LOOKUP_VLAN reduces a VLAN egress to its physical parent plus the tag, and BPF_FIB_LOOKUP_VLAN_INPUT scopes the lookup to a VLAN subinterface. BPF_FIB_LOOKUP_VLAN is XDP-only, since VLAN devices have no XDP xmit; the tc helper rejects it with -EINVAL, which the table runner asserts for every flag arm, and the egress result is checked through bpf_xdp_fib_lookup(). Non-VLAN cases run through both helpers and assert the path-independent results match; the XDP loop also checks dmac and, for the tot_len cases, the route mtu_result, so the VLAN-egress dmac and frag-needed coverage stays even though the tc path no longer reaches it. The egress arms pin the reduction (parent ifindex plus tag, including via a neighbour on the VLAN device, in OUTPUT mode, over a bond, and through a DIRECT|TBID table) and the failure contract: a stacked-VLAN (QinQ) egress returns BPF_FIB_LKUP_RET_VLAN_FAILURE with params->ifindex left at the input. That is distinct from a no-neighbour return, which reports the egress ifindex; only VLAN_FAILURE rewinds params->ifindex, and a guard arm whose input and egress devices differ pins the distinction. The VLAN_FAILURE arms are IPv4; the IPv6 path reaches it through the same shared code, so an IPv6 arm would only re-test that. The input arms use an iif rule that routes one destination to two gateways, so the asserted gateway reveals which device the lookup used as ingress, including VRF table selection through the l3mdev rule and l3mdev_fib_table_rcu(). The VRF arms are IPv4-only: the l3mdev match and table resolution are family-independent core shared by both rule paths, and the IPv6 iif feed is pinned by the IPv6 VLAN input arm. A cross-netns subtest moves a VLAN device into a second netns while it stays registered on its parent and checks both directions fail closed at the boundary. A live-frames subtest (test_fib_lookup_vlan_redirect, with BPF_F_TEST_XDP_LIVE_FRAMES) drives real frames through the native xdp_do_redirect() / xdp_do_flush() path: a reducible egress is redirected to the parent and delivered to its peer, while a QinQ egress is passed to the stack, since redirecting to the VLAN device would drop the frame at flush (no ndo_xdp_xmit). The remaining per-case assertions are in the test table: resolution semantics, the -EINVAL and NOT_FWDED error arms, and the SRC/SKIP_NEIGH combinations. Signed-off-by: Avinash Duduskar <avinash.duduskar@gmail.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260713162305.1237211-4-avinash.duduskar@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-15bpf: Add BPF_FIB_LOOKUP_VLAN_INPUT flag to bpf_fib_lookup() helperAvinash Duduskar
BPF_FIB_LOOKUP_VLAN resolves a VLAN egress. The reverse is also useful: an XDP program receiving a VLAN-tagged frame on a physical device wants the lookup to behave as if the packet had arrived on the corresponding VLAN subinterface, so iif-based policy routing and VRF table selection use the right ingress. Add BPF_FIB_LOOKUP_VLAN_INPUT. When set, params->h_vlan_proto and params->h_vlan_TCI are read as an input VLAN tag and the matching VLAN device of params->ifindex is resolved with __vlan_find_dev_deep_rcu(). The device must be up and in the same network namespace as params->ifindex (a VLAN device can be moved to another netns while registered on its parent; receive would deliver into that other namespace, which a lookup here cannot represent). If params->ifindex is itself a VLAN device, its inner (QinQ) subinterface is matched. For a bond or team, a tag on a port matches no device and returns NOT_FWDED; pass the master's ifindex. The lookup then runs with the resolved device as the ingress; params->ifindex itself is not modified on the input side. When the resolved device is enslaved to a VRF, both the full lookup (via the l3mdev rule) and BPF_FIB_LOOKUP_DIRECT (via l3mdev_fib_table_rcu()) select the VRF's table from the resolved ingress. That follows from feeding the resolved device to the flow as the ingress (fl4.flowi4_iif = dev->ifindex), which is what makes l3mdev resolve the VRF master from the subinterface rather than from params->ifindex. The two failure classes get different treatment on purpose. A h_vlan_proto other than 802.1Q/802.1ad is API misuse and returns -EINVAL, since it would otherwise reach the WARN in vlan_proto_idx() with a program-controlled value. An unmatched VID, a device that is down, or one in another namespace is a data outcome and returns BPF_FIB_LKUP_RET_NOT_FWDED, matching the DIRECT path when fib_get_table() finds no table and mirroring real ingress, where the receive path drops such frames. A VID of 0 (a priority tag) is looked up literally and normally fails the same way; receive instead processes such frames untagged, so callers should not set the flag for priority tags. Proceeding on the physical device for any of these would be fail-open for the policy-routing cases above. The h_vlan fields share a union with tbid, so the flag cannot be combined with BPF_FIB_LOOKUP_TBID. It describes ingress, so it also cannot be combined with BPF_FIB_LOOKUP_OUTPUT. Both combinations return -EINVAL; restricting now keeps a later relaxation backward compatible. Combining with BPF_FIB_LOOKUP_VLAN is allowed: the tag is consumed on the ingress side and the egress tag is written on success. Under !CONFIG_VLAN_8021Q the __vlan_find_dev_deep_rcu() stub returns NULL, so every lookup with a valid proto returns NOT_FWDED, which is correct since no VLAN device can exist. Suggested-by: Toke Høiland-Jørgensen <toke@redhat.com> Signed-off-by: Avinash Duduskar <avinash.duduskar@gmail.com> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260713162305.1237211-3-avinash.duduskar@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-15bpf: Add BPF_FIB_LOOKUP_VLAN flag to bpf_fib_lookup() helperAvinash Duduskar
bpf_fib_lookup() returns the FIB-resolved egress ifindex straight from the fib result. When the egress is a VLAN device, the returned ifindex is the VLAN netdev's, which has no XDP xmit handler; XDP programs that want to forward the frame (e.g. xdp-forward) must instead target the underlying physical device and push the VLAN tag themselves. Today the program has no way to learn either the underlying ifindex or the VLAN tag without maintaining its own VLAN-to-ifindex map in userspace and refreshing it on netlink events. Add BPF_FIB_LOOKUP_VLAN. When the caller sets this flag and the fib result is a VLAN device whose immediate parent is a real (non-VLAN) device in the same network namespace, populate the existing output fields params->h_vlan_proto and params->h_vlan_TCI from the VLAN device and replace params->ifindex with the parent's ifindex. params->h_vlan_TCI carries the VID only, with PCP and DEI bits zero; a consumer wanting to set egress priority writes PCP itself. params->smac is the VLAN device's own address, which can differ from the parent's. Only the immediate parent is resolved, via vlan_dev_priv(dev)->real_dev and not vlan_dev_real_dev(), which walks to the bottom of a stack. When the immediate parent is not a real device in the same namespace, the lookup returns BPF_FIB_LKUP_RET_VLAN_FAILURE and leaves params->ifindex at the input. This covers a stacked VLAN (QinQ), where the immediate parent is itself a VLAN device and one h_vlan_proto/h_vlan_TCI pair cannot describe two tags, and a parent in another network namespace (a VLAN device can be moved while its parent stays), whose ifindex would be meaningless in the caller's namespace. A program that wants the VLAN device's own ifindex re-issues the lookup, with a re-initialized params, without BPF_FIB_LOOKUP_VLAN, so the unreducible case stays distinct from a physical egress. That distinction matters for XDP: a program cannot xmit on a VLAN device, so a success carrying the VLAN ifindex would make it redirect to a device with no ndo_xdp_xmit and drop the frame at xdp_do_flush(). The swap and the vlan fields are written only on the reduce path; other output fields keep their existing behaviour, so a frag-needed result still reports the route mtu in params->mtu_result. BPF_FIB_LOOKUP_VLAN is only useful to XDP, which cannot redirect to a VLAN device. A tc program can redirect to the VLAN device directly, so bpf_skb_fib_lookup() rejects the flag with -EINVAL; bpf_xdp_fib_lookup() accepts it. When the flag is not set, behaviour is unchanged: h_vlan_proto and h_vlan_TCI are zeroed and ifindex is left at the FIB result. The new block is compiled only under CONFIG_VLAN_8021Q since vlan_dev_priv() is not defined otherwise; without that config is_vlan_dev() is constant false and the flag is accepted but never acts. That is safe because no VLAN device can exist there, so every egress is already physical. This lets an XDP redirect target the physical device and learn the tag to push in a single lookup, which xdp-forward's optional VLAN mode (xdp-project/xdp-tools#504) wants from the kernel side. The helper's input semantics are unchanged; the reverse direction (supplying a tag as lookup input) is added in the following patch. Suggested-by: Toke Høiland-Jørgensen <toke@redhat.com> Signed-off-by: Avinash Duduskar <avinash.duduskar@gmail.com> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: David Ahern <dsahern@kernel.org> Link: https://lore.kernel.org/bpf/20260713162305.1237211-2-avinash.duduskar@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-15vdso: Rename HAVE_GENERIC_VDSO to VDSO_DATASTOREThomas Weißschuh
Over time the meaning of HAVE_GENERIC_VDSO has become off. Today it only controls the availability of the vDSO datastore. Rename the symbol to match its function. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Link: https://patch.msgid.link/20260709-vdso-have_generic_vdso-v1-6-d2e1061f268b@linutronix.de
2026-07-15vdso: Drop HAVE_GENERIC_VDSO from architecture kconfig filesThomas Weißschuh
Now that GENERIC_GETTIMEOFDAY and VDSO_GETRANDOM enable HAVE_GENERIC_VDSO automatically, the architecture specific kconfig files do not need to do so anymore. Remove the corresponding lines. Keep them for riscv, loongarch and powerpc as those have their own explicit usage of the vDSO datastore provided by HAVE_GENERIC_VDSO. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Link: https://patch.msgid.link/20260709-vdso-have_generic_vdso-v1-5-d2e1061f268b@linutronix.de
2026-07-15vdso: Automatically select HAVE_GENERIC_VDSO if necessaryThomas Weißschuh
gettimeofday() and getrandom() in the vDSO require the vDSO datastore. Enable it automatically if either one of them is enabled so the architecture code doesn't need to know this. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Link: https://patch.msgid.link/20260709-vdso-have_generic_vdso-v1-4-d2e1061f268b@linutronix.de
2026-07-15MIPS: vdso: Stop using CONFIG_HAVE_GENERIC_VDSOThomas Weißschuh
HAVE_GENERIC_VDSO is about to become an implementation detail. Use the MIPS-specific symbol instead. It is equivalent here. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Link: https://patch.msgid.link/20260709-vdso-have_generic_vdso-v1-3-d2e1061f268b@linutronix.de
2026-07-15vdso: Remove the dependency on HAVE_GENERIC_VDSO from ARCH_HAS_VDSO_ARCH_DATAThomas Weißschuh
Align ARCH_HAS_VDSO_ARCH_DATA with ARCH_HAS_VDSO_TIME_DATA, making it selectable even without HAVE_GENERIC_VDSO. It will only have an effect when HAVE_GENERIC_VDSO is enabled anyways, but this makes the architecture Kconfig files a bit simpler. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Link: https://patch.msgid.link/20260709-vdso-have_generic_vdso-v1-2-d2e1061f268b@linutronix.de
2026-07-15futex: Remove dependency on HAVE_GENERIC_VDSO from FUTEX_ROBUST_UNLOCKThomas Weißschuh
The robust futex unlock functionality has no relation to the generic vDSO functionality. Remove the dependency. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Link: https://patch.msgid.link/20260709-vdso-have_generic_vdso-v1-1-d2e1061f268b@linutronix.de
2026-07-15RDMA/rxe: Reject unimplemented implicit ODP cleanlyxiongweimin
rxe advertises ODP but not IB_ODP_SUPPORT_IMPLICIT. The reg_user_mr path still contained a dead branch that checked the implicit capability and could never succeed. Return -EOPNOTSUPP for the implicit ODP address range up front so the intent is obvious and the unreachable code is gone. Signed-off-by: xiongweimin <xiongweimin@kylinos.cn> Cc: linux-rdma@vger.kernel.org Cc: Jason Gunthorpe <jgg@nvidia.com> Link: https://patch.msgid.link/20260713010439.331054-1-15927021679@163.com Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-15RDMA/addr: fix spelling of guarantees in commentxiongweimin
Correct "guarentees" to "guarantees" when describing work cancel. Signed-off-by: xiongweimin <xiongweimin@kylinos.cn> Link: https://patch.msgid.link/20260714024429.188276-1-15927021679@163.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-15Merge branch 'bpf-sockmap-fix-sockmap-leaking-udp-socks'Kumar Kartikeya Dwivedi
Michal Luczaj says: ==================== bpf, sockmap: Fix sockmap leaking UDP socks Fix for UDP sockets getting leaked during sockmap lookup/release. Accompanied by selftests updates. Two Sashiko's concerns to be addressed separately: https://lore.kernel.org/bpf/20260626205814.BAC3C1F000E9@smtp.kernel.org/ Signed-off-by: Michal Luczaj <mhal@rbox.co> --- Changes in v4: - selftest: drop redundant `if (err)` [Sashiko] - Link to v3: https://patch.msgid.link/20260702-sockmap-lookup-udp-leak-v3-0-ff8de8782468@rbox.co Changes in v3: - selftest: better error handling, ASSERT_*() macros [Sashiko] - selftest: fix grammar, reorder patches [Kuniyuki] - Link to v2: https://patch.msgid.link/20260626-sockmap-lookup-udp-leak-v2-0-7e7e201c951a@rbox.co Changes in v2: - selftest: drop the original, adapt old tests - fix: change approach to rejecting unbound UDP [Kuniyuki] - Link to v1: https://patch.msgid.link/20260623-sockmap-lookup-udp-leak-v1-0-05804f9308e4@rbox.co To: Alexei Starovoitov <ast@kernel.org> To: Daniel Borkmann <daniel@iogearbox.net> To: Andrii Nakryiko <andrii@kernel.org> To: Eduard Zingerman <eddyz87@gmail.com> To: Kumar Kartikeya Dwivedi <memxor@gmail.com> To: Martin KaFai Lau <martin.lau@linux.dev> To: Song Liu <song@kernel.org> To: Yonghong Song <yonghong.song@linux.dev> To: Jiri Olsa <jolsa@kernel.org> To: Emil Tsalapatis <emil@etsalapatis.com> To: Shuah Khan <shuah@kernel.org> To: John Fastabend <john.fastabend@gmail.com> To: Jakub Sitnicki <jakub@cloudflare.com> To: Jiayuan Chen <jiayuan.chen@linux.dev> To: Eric Dumazet <edumazet@google.com> To: Kuniyuki Iwashima <kuniyu@google.com> To: Paolo Abeni <pabeni@redhat.com> To: Willem de Bruijn <willemb@google.com> To: "David S. Miller" <davem@davemloft.net> To: Jakub Kicinski <kuba@kernel.org> To: Simon Horman <horms@kernel.org> To: Cong Wang <cong.wang@bytedance.com> Cc: bpf@vger.kernel.org Cc: linux-kselftest@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: netdev@vger.kernel.org --- ==================== Link: https://patch.msgid.link/20260707-sockmap-lookup-udp-leak-v4-0-f878346f27ab@rbox.co Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-15selftests/bpf: Fail unbound UDP on sockmap updateMichal Luczaj
sockmap now rejects unbound UDP sockets. Adjust test_maps. While at it, check socket()'s return value. This effectively reverts commit c39aa2159974 ("bpf, selftests: Fix test_maps now that sockmap supports UDP"). Signed-off-by: Michal Luczaj <mhal@rbox.co> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://lore.kernel.org/bpf/20260707-sockmap-lookup-udp-leak-v4-4-f878346f27ab@rbox.co Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-15selftests/bpf: Adapt sockmap update error handlingMichal Luczaj
Update sockmap_listen to accommodate the recent change in sockmap that rejects unbound UDP sockets. TCP: Reject unbound and bound (unless established or listening). UDP: Accept only bound sockets. While at it, migrate to ASSERT_* and enforce reverse xmas tree. Signed-off-by: Michal Luczaj <mhal@rbox.co> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://lore.kernel.org/bpf/20260707-sockmap-lookup-udp-leak-v4-3-f878346f27ab@rbox.co Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-15bpf, sockmap: Reject unhashed UDP sockets on sockmap updateMichal Luczaj
UDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means sk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false. Because sockmap accepts unbound UDP sockets, a BPF program can increment a socket's refcount via lookup. If the socket is subsequently bound, the transition from unbound to bound causes bpf_sk_release() to skip the decrement of the refcount, causing a memory leak. unreferenced object 0xffff88810bc2eb40 (size 1984): comm "test_progs", pid 2451, jiffies 4295320596 hex dump (first 32 bytes): 7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00 ................ 02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace (crc bdee079d): kmem_cache_alloc_noprof+0x557/0x660 sk_prot_alloc+0x69/0x240 sk_alloc+0x30/0x460 inet_create+0x2ce/0xf80 __sock_create+0x25b/0x5c0 __sys_socket+0x119/0x1d0 __x64_sys_socket+0x72/0xd0 do_syscall_64+0xa1/0x5f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Instead of special-casing for refcounted sockets, reject unhashed UDP sockets during sockmap updates, as there is no benefit to supporting those. This effectively reverts the commit under Fixes, with two exceptions: 1. sock_map_sk_state_allowed() maintains a fall-through `return true`. 2. In the spirit of commit b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap usage"), the proto::unhash BPF handler is not reintroduced. Historical note: this issue is related to commit 67312adc96b5 ("bpf: reject unhashed sockets in bpf_sk_assign"). Fixes: 0c48eefae712 ("sock_map: Lift socket state restriction for datagram sockets") Suggested-by: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Michal Luczaj <mhal@rbox.co> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Reviewed-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20260707-sockmap-lookup-udp-leak-v4-2-f878346f27ab@rbox.co Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-15selftests/bpf: Ensure UDP sockets are boundMichal Luczaj
Update sockmap_basic tests to bind sockets before they are used. This accommodates the recent change in sockmap that rejects unbound UDP sockets. Signed-off-by: Michal Luczaj <mhal@rbox.co> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://lore.kernel.org/bpf/20260707-sockmap-lookup-udp-leak-v4-1-f878346f27ab@rbox.co Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-15drm/i915/display: sagv pre/post plane calls to check pmdemand supportVinod Govindapillai
For pmdemand cases, no need to even calculate the masks based on the qgv points index. Though the current logic avoids setting the registers based on the pmdemand support, some qgv point masks are compared in vain and do nothing. So leave early if pmdemand is supported. Signed-off-by: Vinod Govindapillai <vinod.govindapillai@intel.com> Reviewed-by: Mika Kahola <mika.kahola@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260615203355.218578-4-vinod.govindapillai@intel.com
2026-07-15drm/i915/pm_demand: introduce HAS_PMDEMAND macroVinod Govindapillai
PM demand feature introduces a new way to set bw, power and performance requirements to pcode from display version 14 onwards. Use an identifiable name as a macro to distinguish the pm demand specific changes in the code. Signed-off-by: Vinod Govindapillai <vinod.govindapillai@intel.com> Reviewed-by: Mika Kahola <mika.kahola@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260615203355.218578-3-vinod.govindapillai@intel.com
2026-07-15drm/i915/wm: clear the plane ddb_y entries on plane disableVinod Govindapillai
The UV/Y plane DDB entriess are never cleared on sk_wm_plane_disable_noatomic() and can leave stale DDB state for NV12 planes on pre-Gen11 devices Fixes: d34b59d5ba41 ("drm/i915: Add skl_wm_plane_disable_noatomic()") Assisted-by: Copilot:claude-sonnet-4.6 Signed-off-by: Vinod Govindapillai <vinod.govindapillai@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260615203355.218578-2-vinod.govindapillai@intel.com
2026-07-15OPP: Fix cleanup orderingGregor Herburger
Commit 173e02d67494 ("OPP: Initialize scope-based pointers inline") added initialization for all pointers. In some cases, the ordering was changed so that *opp_table was initialized after *opp. This also changes the order of the registered cleanup functions. When the cleanup happens, this can cause use-after-free errors when the last reference is released and the release function _opp_kref_release tries to access the already freed opp->opp_table. Initialize *opp_table before *opp again to fix this and ensure the correct cleanup order. Fixes: 173e02d67494 ("OPP: Initialize scope-based pointers inline") Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-07-15RDMA/cma: fix spelling of guarantees in commentxiongweimin
Correct "guarentees" to "guarantees" when describing handler teardown. Signed-off-by: xiongweimin <xiongweimin@kylinos.cn> Link: https://patch.msgid.link/20260714024423.188238-1-15927021679@163.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-15media: i2c: vd55g1: Add support for vd55g4Benjamin Mugnier
vd55g4 is the same device as vd65g4 but outputs in monochrome instead of RGB. Adapt the driver structure according to this new variant, and add its support. Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: dt-bindings: vd55g1: Add vd55g4 compatibleBenjamin Mugnier
Define it as a new monochrome variant of vd65g4. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: i2c: vd55g1: Fix manual digital gain on color variantBenjamin Mugnier
Apply digital gain to all channels, each channel representing a color. Cc: stable@vger.kernel.org Fixes: e138e7f00042 ("media: i2c: vd55g1: Add support for vd65g4 RGB variant") Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: i2c: vd55g1: Remove spurious pad format update on init_state()Benjamin Mugnier
vd55g1_update_pad_fmt() is called in vd55g1_init_state(). But vd55g1_set_pad_fmt(), called at the end of vd55g1_init_state(), also calls vd55g1_update_pad_fmt() itself. Enhance readability and clear confusion by only preparing the format in vd55g1_init_state() and let vd55g1_set_pad_fmt() update it instead, effectively calling it only 1 time instead of 2. Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: i2c: vd55g1: Fix media bus code initializationBenjamin Mugnier
In the driver initialization, the index of the default media bus code from the supported media bus code array is passed directly to the vd55g1_get_fmt_code() function instead of the proper media bus code. This works correctly as a proper media bus code is set after initialization but could not have been the case. This also resulted in mutliple "Unsupported mbus format" error messages. Retrieve the media bus code from the media bus code array, and pass this media bus code to vd55g1_get_fmt_code() instead of the code index. Rename VD55G1_MBUS_CODE_DEF to VD55G1_MBUS_CODE_IDX_DEF and VD55G1_MODE_DEF to VD55G1_MODE_IDX_DEF while at it to avoid future confusions. Display the guilty error code in warning message. Cc: stable@vger.kernel.org Fixes: e138e7f00042 ("media: i2c: vd55g1: Add support for vd65g4 RGB variant") Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: ipu6: Do not free aux device pdata after initRuoyu Wang
ipu6_bus_initialize_device() stores the isys/psys pdata pointer in struct ipu6_bus_device and initializes the auxiliary device. After that point, error unwinding must drop the auxiliary device reference and let ipu6_bus_release() free both the bus device and adev->pdata. The isys and psys init paths already call put_device() when MMU initialization fails, and ipu6_bus_add_device() calls auxiliary_device_uninit() on auxiliary_device_add() failure. Both paths therefore run the bus release callback. The extra kfree(pdata) in the callers can release the same object a second time. Remove the manual pdata frees after the auxiliary device has been initialized. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: cb3117b074ae ("media: intel/ipu6: add IPU auxiliary devices") Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: i2c: ov8865: Program the sensor on stream startJurison Murati
The sensor registers are only written in the runtime PM resume handler; ov8865_set_fmt() merely stores the requested mode, relying on the sensor being runtime suspended between uses so that the next resume applies it. That assumption breaks when something keeps the sensor powered. On IPU3 platforms, ipu_bridge instantiates the VCM device with a DL_FLAG_PM_RUNTIME device link to the sensor, so a userspace process holding the VCM subdev open (e.g. wireplumber's camera monitor) pins the sensor runtime-active. A subsequent set_fmt() then never reaches the hardware: the sensor keeps streaming the mode programmed on the last resume while the CSI-2 receiver expects the newly negotiated format. On a Surface Book 2 (IPU3, ov8865 + dw9719 VCM), requesting the 3264x2448 mode while the hardware was left programmed for the 1632x1224 binned mode makes ipu3-cio2 report "frame sync error" and "payload length is 10340352, received 2585088" (exactly one binned frame) for every frame, and the inverse case stalls the stream after a single frame. Camera applications end up displaying one bogus frame forever. Program the sensor configuration and apply the control values on stream start instead, where the negotiated mode is always current, and only write the configuration in the runtime PM resume handler when resuming with the stream already started. Signed-off-by: Jurison Murati <eng.juri@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: i2c: ov8865: Drop the runtime PM usage count on stream failureJurison Murati
ov8865_s_stream() takes a runtime PM reference when enabling the stream, but returns without releasing it if ov8865_sw_standby() fails, leaving the reference unbalanced and the sensor powered indefinitely. The same applies to a failure while disabling the stream, in which case the reference acquired at stream start is never dropped. Drop the reference in a single place, both when disabling the stream and on failure, and only update the streaming state on success. Signed-off-by: Jurison Murati <eng.juri@gmail.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: bcm2835-unicam: Fix asc leaked in error/remove pathEugen Hristev
v4l2_async_nf_add_fwnode_remote() allocates the asc, which is freed when v4l2_async_nf_cleanup() is called. Call v4l2_async_nf_cleanup() properly in the driver paths. Discovered with kmemleak after rmmod: unreferenced object 0xffff000084526b80 (size 64): comm "modprobe", pid 185, jiffies 4295013512 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 e8 0d ff bf 00 00 ff ff ................ 40 83 bc 84 00 00 ff ff 60 83 bc 84 00 00 ff ff @.......`....... backtrace (crc ac584083): [<00000000ffb081a7>] kmemleak_alloc+0x38/0x44 [<00000000d2fd9301>] __kmalloc+0x1b0/0x250 [<000000004dd5354d>] __v4l2_async_nf_add_fwnode+0x28/0x9c [<0000000067587657>] __v4l2_async_nf_add_fwnode_remote+0x3c/0x64 Fixes: 392cd78d495f ("media: bcm2835-unicam: Add support for CCP2/CSI2 camera interface") Signed-off-by: Eugen Hristev <ehristev@kernel.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: intel: ipu-bridge: add blank line after declarationsHungyu Lin
Add a blank line between the local variable declarations and the following statement in ipu_bridge_get_ivsc_acpi_dev(). Also remove an unnecessary blank line within the declaration block. This addresses a checkpatch.pl warning. No functional change intended. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: i2c: gc0310: Use devm_v4l2_sensor_clk_get()Sanjay Chitroda
Several camera sensor drivers access the "clock-frequency" property directly to retrieve the external clock rate or handle the external clock manually in the driver. While this is valid on a subset of ACPI platforms, implementing this logic directly in drivers is deprecated and can lead to inconsistent behaviour across drivers. This driver supports ACPI platforms only. It currently retrieves the external clock rate from the "clock-frequency" property and fails probing if the rate does not match the expected value, which is the correct policy for ACPI platforms. Switch to using the devm_v4l2_sensor_clk_get() helper to standardise clock handling. This preserves the existing behaviour on ACPI platforms that specify a clock-frequency property without providing a clock. On platforms that provide a clock, the helper will program the clock to the rate specified by clock-frequency, which is also consistent with the driver's expectations. Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15media: platform: amd: fix unmet dependency for VIDEO_V4L2_SUBDEV_APIJulian Braha
Currently, VIDEO_AMD_ISP4_CAPTURE selects VIDEO_V4L2_SUBDEV_API without ensuring MEDIA_CONTROLLER is enabled, causing an unmet dependency: WARNING: unmet direct dependencies detected for VIDEO_V4L2_SUBDEV_API Depends on [n]: MEDIA_SUPPORT [=m] && VIDEO_DEV [=m] && MEDIA_CONTROLLER [=n] Selected by [m]: - VIDEO_AMD_ISP4_CAPTURE [=m] && MEDIA_SUPPORT [=m] && MEDIA_PLATFORM_SUPPORT [=y] && MEDIA_PLATFORM_DRIVERS [=y] && DRM_AMDGPU [=m] && DRM_AMD_ISP [=y] && HAS_DMA [=y] && VIDEO_DEV [=m] Many other options in this subsystem select MEDIA_CONTROLLER, let's do the same here. This unmet dependency bug was detected by kconfirm, a static analysis tool for Kconfig. Fixes: 9a54c285630c ("media: platform: amd: Introduce amd isp4 capture driver") Signed-off-by: Julian Braha <julianbraha@gmail.com> Reviewed-by: Bin Du <bin.du@amd.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>