summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-08-01wifi: mt76: fix stuck TX queues after SER with no active interfacesChad Monroe
When a firmware watchdog triggers full SER recovery before any VAPs are up, mac80211 skips drv_reconfig_complete() because open_count is zero. This leaves the DRIVER queue stop reason set permanently, blocking all TX when interfaces eventually start. Signed-off-by: Chad Monroe <chad@monroe.io> Link: https://patch.msgid.link/20260724124813.3961474-22-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-08-01wifi: mt76: mt7996: select net_setup_tc handler at runtimeChad Monroe
The net_setup_tc callback is chosen at compile time and the WED handler shadows the NPU one when CONFIG_NET_MEDIATEK_SOC_WED is enabled. mt76_wed_net_setup_tc() returns -EOPNOTSUPP without an active WED device, so on boards using the Airoha NPU with a WED enabled kernel the tc offload block is never bound and PPE flow offload for wireless traffic is silently disabled. Dispatch on the active offload backend instead: use the WED handler when a WED device is attached and fall back to the NPU handler otherwise. Builds without MT76_NPU keep the old behavior through the mt76_npu_net_setup_tc() stub. Signed-off-by: Chad Monroe <chad@monroe.io> Link: https://patch.msgid.link/20260724124813.3961474-21-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-08-01wifi: mt76: fix queue reg access when building WED and NPU togetherFelix Fietkau
Move the offload specific parts of Q_READ/Q_WRITE into mt76_dma_handle_read/write, which return false to fall back to readl/writel. The WED and NPU #ifdefs now live inside those helpers instead of selecting between mutually exclusive macro definitions, so a kernel with both enabled supports both at runtime. Also fixes the NPU path dereferencing a hardcoded q instead of the macro argument. Link: https://patch.msgid.link/20260724124813.3961474-20-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-08-01wifi: mt76: mt7996: wake MCU waiters before aborting scan in L1 SERFelix Fietkau
The L1 reset path calls mt76_abort_scan() between setting MT76_MCU_RESET and waking mcu.wait. A scan work blocked on an in-flight MCU command does not re-evaluate its wait condition until woken, so the cancel_delayed_work_sync() inside the abort sleeps out the full MCU timeout before recovery can proceed, adding several seconds of SER latency. mt7996_mac_full_reset() and the mt7915 counterpart already order the wake-up first. Wake mcu.wait immediately after setting MT76_MCU_RESET so in-flight commands bail out before the abort synchronises against them. Fixes: b36d55610215 ("wifi: mt76: abort scan/roc on hw restart") Link: https://patch.msgid.link/20260724124813.3961474-19-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-08-01wifi: mt76: mt7996: skip key upload when adding an offchannel linkFelix Fietkau
No hw keys are ever uploaded for scanning/roc links and the link remove path already skips the key iteration for them. The add path still runs it, and since mt7996_set_hw_key() resolves the target through mvif->link[link_id] rather than the offchannel link, starting a scan on another band re-uploads the group keys of the link sharing the same link_id, re-sending its BSS cipher info and, for BIGTK with beacon protection on an AP link, toggling its beacons off and on. Skip the key iteration for offchannel links, mirroring the remove path. Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy") Link: https://patch.msgid.link/20260724124813.3961474-18-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-08-01wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreementFelix Fietkau
The flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind that mt7915_mac_twt_sched_list_add() later walks. Fixes: 3782b69d03e7 ("mt76: mt7915: introduce mt7915_mac_add_twt_setup routine") Link: https://patch.msgid.link/20260724124813.3961474-17-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-08-01wifi: mt76: mt7996: leave PS when a 4-address connection is establishedPeter Chiu
Because 4 address non-AMSDU packets do not have a bssid field, the hardware cannot get the bssid. Without the bssid, stations are not able to leave PS mode due to HW design. Wake up non-setup links when 4-address mode is established to prevent this issue. mt7992 and mt7990 handle this via the BSSID mapping band config instead, so restrict the command to mt7996. Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com> Link: https://patch.msgid.link/20260724124813.3961474-16-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-31accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()Lizhi Hou
In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears VM_PFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls madvise(MADV_DONTNEED), the PTEs will be successfully cleared because VM_MIXEDMAP allows this (unlike VM_PFNMAP). When userspace subsequently accesses the memory, drm_gem_shmem_fault() handles the page fault and attempts to map the backing shmem page via vmf_insert_pfn() which calls vmf_insert_pfn_prot(). Because the backing shmem page is normal system memory (pfn_valid(pfn) is true) and the VMA now has VM_MIXEDMAP set, won't this predictably trigger the explicit assertion BUG_ON((vma->vm_flags & VM_MIXEDMAP) && pfn_valid(pfn)) Fix by removing the vm_flags_mod() call and replacing the vm_insert_pages() pre-population with the handle_mm_fault() loop that was already used for the import (dma-buf) path. Fixes: e486147c912f ("accel/amdxdna: Add BO import and export") Reviewed-by: Max Zhen <max.zhen@amd.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260731185955.3449311-1-lizhi.hou@amd.com
2026-08-01PCI: Use %pe format specifier to print error pointersKrzysztof Wilczyński
Currently, several files in the PCI tree print error pointers using the %ld format specifier together with an explicit PTR_ERR() conversion, which prints the numeric errno value. Thus, at every affected call site, use the %pe format specifier, which exists specifically to print error pointers, and pass the error pointer directly. With CONFIG_SYMBOLIC_ERRNAME enabled, this prints a symbolic error name such as -ENOMEM, falling back to the numeric errno value otherwise. As such, the explicit PTR_ERR() conversion is no longer needed. No functional changes intended. Link: https://patch.msgid.link/20260720210839.1507406-1-kwilczynski@kernel.org Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
2026-07-31net/mlx5: fw_tracer, return NULL on create errorMichael Guralnik
Tracer creation can fail by returning either NULL or ERR_PTR. The return value is stored without a check on the device, and users treat ERR_PTR and NULL the same way. This also causes a crash in the core dump logic, which is missing the ERR_PTR check and ends up dereferencing it, as shown in the trace below. Switch tracer creation to return NULL on failure only, so callers only need a single NULL check. Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: mlx5_ib ib_uverbs ib_core ipv6 mlx5_core CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.7 #1 PREEMPT(none) Workqueue: mlx5_health0001:01:00.0 mlx5_fw_reporter_err_work [mlx5_core] pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] lr : mlx5_fw_tracer_trigger_core_dump_general+0x40/0xe0 [mlx5_core] sp : ffff800081cf3c40 x29: ffff800081cf3c90 x28: 0000000000000000 x27: 0000000000000000 x26: ffff000080018828 x25: 0000000000000000 x24: ffff000080304a05 x23: ffff800081cf3d80 x22: ffff0000847e01a0 x21: 0000000000000000 x20: ffff0000847e01a0 x19: ffffffffffffffa1 x18: ffff80008310bbf0 x17: ffff800080119650 x16: ffff80008010df54 x15: ffff80008010d4ac x14: ffff800079c202e4 x13: ffff80008002fe60 x12: ffff800080119650 x11: ffff80008010df54 x10: ffff80008010d4ac x9 : ffff800079c203d8 x8 : ffff800081cf3c88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000030 x2 : 0000000000000008 x1 : 0000000000000000 x0 : 00000000c5c4000e Call trace: mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] (P) mlx5_fw_reporter_dump+0x30/0x2e0 [mlx5_core] devlink_health_do_dump+0x9c/0x160 devlink_health_report+0x1c0/0x288 mlx5_fw_reporter_err_work+0xac/0xc0 [mlx5_core] process_one_work+0x15c/0x3d8 worker_thread+0x18c/0x320 kthread+0x148/0x228 ret_from_fork+0x10/0x20 Code: b9400000 5ac00800 7a401800 540003ca (3940a260) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x000000,00078031,75fce5a1,35fffe67 Memory Limit: none ---[ end Kernel panic - not syncing: Oops: Fatal exception ]--- Fixes: fd1483fe1f9f ("net/mlx5: Add support for FW reporter dump") Signed-off-by: Michael Guralnik <michaelgur@nvidia.com> Reviewed-by: Shay Drori <shayd@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260729080402.2427184-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net/mlx5: SF, Handle function changed eventChris Mi
When host is powered off, firmware does not send vhca_state event for every probed host SF on the DPU because it may have deployed thousands of SFs to the host. Instead it sends a function changed event. Currently, only VFs handle this event. This commit extends support to SFs. When DPU user deactivates[1] SFs, mlx5 expects vhca_state event and leaves the SF in dangling state[2]. When DPU user deletes[3] SFs, mlx5 also expects vhca_state event and destroys the SF resources[4]. Fix it by changing SF to the right state and freeing SF resources when the function changed event is received. When this event is received, driver checks all SF states. - If state is in_use, change it to active. - If state is teardown_request, change it to allocated. And SF hardware table entry is freed if it is pending for delete. [1] # devlink port function set en3f0c1pf0sf0 state inactive [2] # devlink port function set en3f0c1pf0sf0 state active Error: mlx5_core: SF is inactivated but it is still attached. kernel answers: Device or resource busy [3] # devlink port show pci/0000:03:00.0/229376: type eth netdev en3f0c1pf0sf0 \ flavour pcisf controller 1 pfnum 0 sfnum 0 splittable false function: hw_addr 00:00:00:00:00:00 state active opstate attached \ roce enable trust off max_uc_macs 4096 max_io_eqs 8 # devlink port del en3f0c1pf0sf0 [4] # devlink port add pci/0000:03:00.0 flavour pcisf pfnum 0 sfnum 0 \ controller 1 Error: mlx5_core: SF already exist. Choose different sfnum. kernel answers: File exists Fixes: 6a3273217469 ("net/mlx5: SF, Port function state change support") Signed-off-by: Chris Mi <cmi@nvidia.com> Reviewed-by: Shay Drori <shayd@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260729071622.2423270-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: phy: realtek: add support for RTL8261DJaven Xu
RTL8261D is also 10g phy. It's sub_phy_id is 0x81. And it does not need any firmware. Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20260728073106.1515-6-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: phy: realtek: load firmware for RTL8261C_CGJaven Xu
This patch adds support for loading firmware. Download some parameters for RTL8261C_CG. Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260728073106.1515-5-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: phy: realtek: add support for RTL8261C_CGJaven Xu
This patch adds support for Realtek phy chip RTL8261C_CG. Its PHY ID is 0x001cc898. This patch introduces a distinct family of handlers (probe, get_features, config_aneg, read_status, config_intr, handle_interrupt). Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20260728073106.1515-4-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: phy: c45: add setup and read master/slave helpersJaven Xu
This patch adds two static helpers in drivers/net/phy/phy-c45.c to configure and read back master-slave roles for non BASE-T1 Clause 45 PHYs via the 10GBASE-T AN control/status registers. These helpers are wired into genphy_c45_config_aneg() and genphy_c45_read_status(). This changes the observable ethtool output for drivers using the generic c45 read path. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20260728073106.1515-3-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: phy: c45: add genphy_c45_pma_soft_reset()Javen Xu
Add a generic Clause 45 software reset helper. The helper sets the reset bit in the PMA/PMD control register and waits until the bit is cleared by hardware. Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20260728073106.1515-2-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: hisilicon: hix5hd2_gmac: remove redundant NAPI deleteJiawen Liu
hix5hd2_dev_remove() calls netif_napi_del() before unregister_netdev(). This is not needed because free_netdev() deletes all NAPI instances attached to the net_device. Remove the redundant call and let the networking core tear down the NAPI instance during unregister_netdev(). The probe error path still keeps its explicit netif_napi_del(), because the device has not been registered there. Fixes: 57c5bc9ad7d7 ("net: hisilicon: add hix5hd2 mac driver") Signed-off-by: Jiawen Liu <1298662399@qq.com> Link: https://patch.msgid.link/tencent_5FFD37A252B4FEA6A80AD25B17C8E904F005@qq.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31octeontx2-af: add new mbox to support sync cycle on rx pathSatha Rao
sync ensures that all packets that were in flight are flushed out to memory. This can be used to assist in the tearing down of an active RQ. To complete disabling RQs or disabling SMQ and its SQs, LF software send mbox to AF to complete RX_SW_SYNC. Both VF and PF and invoke this mbox. Signed-off-by: Satha Rao <skoteshwar@marvell.com> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260727101608.300290-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31Merge tag 'ata-7.2-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Damien Le Moal: - Fix PCI resource initialization in the sata_mv driver to keep legacy Marvell boards functional (Rosen) - Fix ahci_ceva driver initialization error path (Radhey) - Fix libata header file to remove a kernel doc compilation warning (Randy) - Increase the timeout for the STANDBY IMMEDIATE command to avoid suspend failures with drives that are slow to respond to this command (Matt) - Fixes for the handling of timed out commands in the presence of deferred non-NCQ commands, to avoid excessive delays in executing the error handler (me) - Disable link power management for a couple of WD drives that have been identified as not functioning properly when power management is used (Niklas) - Fix the device iteration loop when checking for link power management support to correctly handle port multiplier setups (Niklas) * tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-sata: fix ata_scsi_lpm_supported() iteration ata: libata-core: Disable LPM on WD Green 2.5 480GB ata: libata-core: Disable LPM on some WD drives scsi: libsas: terminate deferred commands on time out ata: libata-scsi: schedule deferred atapi command ata: libata-scsi: terminate deferred commands on time out ata: libata-eh: Increase STANDBY IMMEDIATE timeout ata: libata: avoid kernel-doc warnings ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() ata: sata_mv: accept 1 or 2 resources in platform probe
2026-07-31net: stmmac: dwxgmac2: configure INTM for per-channel interrupt routingZxyan Zhu
The XGMAC DMA_MODE register has an INTM field (bits 13:12) that controls interrupt routing behavior for DMA transfer completion events: 00 (default): sbd_perch_* are pulse signals, sbd_intr_o is also asserted for each completion event. 01: sbd_perch_* are level signals, sbd_intr_o is NOT asserted for packet transfer completion events. When multi-MSI is enabled, per-channel TX/RX interrupts are expected to arrive on their dedicated lines. In the default INTM=00 mode, sbd_intr_o also fires for DMA completion events, but the multi-MSI handler stmmac_mac_interrupt() only processes MAC-layer events (LPI, PMT, timestamps) and returns IRQ_NONE for every DMA completion interrupt, resulting in a continuous stream of unhandled interrupts on the common IRQ. Hardware verification with XGMAC and multi-MSI enabled: INTM=00: 5.4 million common IRQ interrupts in 3 seconds, ~1.8 million IRQ_NONE returns per second. INTM=01: 0 common IRQ interrupts, per-channel IRQs work normally, 10G line rate works correctly. Set INTM to mode 1 when multi-MSI is enabled. This matches the existing GMAC4 implementation. XGMAC multi-MSI has never worked correctly since it was introduced. Signed-off-by: Zxyan Zhu <zxyan0222@gmail.com> Reviewed-by: Qingfang Deng <qingfang.deng@linux.dev> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260729023653.1162763-1-zxyan0222@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31Merge tag 'block-7.2-20260731' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - A set of fixes for s390/dasd, via Stefan - Fix for a missing stop of the timeout timer, if a disk has never been added - Clear kernel owned fields on ublk setup by default * tag 'block-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: s390/dasd: Fix undersized format-check buffer s390/dasd: Fix potential NULL pointer dereference s390/dasd: Fix path verification interrupted by concurrent dasd_sleep_on_immediatly block: stop the timeout timer when releasing a never added disk ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
2026-07-31net: dsa: microchip: add two-steps PTP support for KSZ8463Bastien Curutchet (Schneider Electric)
The KSZ8463 switch supports PTP but it's not supported by the driver. Add L2 two-step PTP support for the KSZ8463. IPv4 and IPv6 layers aren't supported. Neither is one-step PTP. Use KSZ8463-specific implementations of the .get_ts_info and .port_hwtstamp_set callbacks. The pdelay_req and pdelay_resp timestamps share one interrupt bit status while they're located in two different registers. So introduce last_tx_is_pdelayresp to keep track of the last sent event type. This flag is set by the xmit worker right before sending the packet and then used in the interrupt handler to retrieve the timestamp location. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-10-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: explicitly enable detection of L2 PTP framesBastien Curutchet (Schneider Electric)
Detection of L2 PTP frames needs to be enabled for PTP to work at the L2 layer. The bit enabling this detection is set by default on the switches currently supported by the driver, but it is unset by default on the KSZ8463 for which support will be added in upcoming patches. Explicitly enable the detection of L2 PTP frames for all switches when PTP is enabled. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-9-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: add KSZ8463 tail tag handlingBastien Curutchet (Schneider Electric)
KSZ8463 uses the KSZ9893 DSA TAG driver. However, the KSZ8463 doesn't use the tail tag to convey timestamps to the host as KSZ9893 does. It uses the reserved fields in the PTP header instead. Add a KSZ8463-specific DSA_TAG driver to handle KSZ8463 timestamps. There is no information in the tail tag to distinguish PTP packets from others so use the ptp_classify_raw() helper to find the PTP packets and extract the timestamp from their PTP headers. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-8-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: adapt port offset for KSZ8463's PTP registerBastien Curutchet (Schneider Electric)
In KSZ8463 register's layout, the offset between port 1 and port 2 registers isn't the same in the generic control register area than in the PTP register area. The get_port_addr() always uses the same offset so it doesn't work when it's used to access PTP registers. Adapt the port offset in get_port_addr() when the accessed register is in the PTP area. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-5-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: add PTP interrupt handling for KSZ8463Bastien Curutchet (Schneider Electric)
KSZ8463 PTP interrupts aren't handled by the driver. The interrupt layout in KSZ8463 has nothing to do with the other switches: - Its global interrupt enable register is 16-bits long and follow an 'enable' logic, instead of a 'mask' one - all the interrupts of all ports are grouped into one status register while others have one interrupt register per port - xdelay_req and pdresp timestamps share one single interrupt bit on the KSZ8463 while each of them has its own interrupt bit on other switches Create a KSZ8463-specific set of interrupt domain operations to handle the global IRQ layer. To limit code duplication, it uses the same interrupt handler than the other switches. Since other switches have 8-bits registers, only the high-byte of the interrupt status/enable registers are used. This high-byte is where the PTP interrupts are located. The low-byte contains the wake-up detection interrupts so if at some points these interrupts are needed we'll need a bit of rework here. Create KSZ8463-specific functions to setup the PTP interrupts. The created IRQ domain is tied to the first port of the KSZ8463. Again, the same PTP interrupt handler than the others switches is used. Implement the teardown callback to release the interrupts. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-4-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: allow the use of other IRQ operations.Bastien Curutchet (Schneider Electric)
The IRQ setup uses an hardcoded set of IRQ operations. These operations don't fit with the KSZ8463 which has an inverted bit logic (it uses an 'enable irq' register instead of a 'mask irq' one) and 16-bits registers. Take the IRQ domain operations as input of ksz_irq_common_setup() to allow KSZ8463 to use the already existing setup with its own set of IRQ operations. Expose ksz_irq_common_setup() and ksz_irq_bus_lock/unlock() so they can be used by ksz8.c. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-3-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: split ksz8_config_cpu_port()Bastien Curutchet (Schneider Electric)
ksz8_config_cpu_port() is only called twice, once by ksz8_setup() and once by ksz8463_setup(). It contains a ksz8463 branch that could be avoided in the ksz8_setup() case and a ksz87xx/ksz88xx branches that could be avoided in ksz8463_setup() case. Create ksz8463_config_cpu_port() that only handles the ksz8463 case and remove the ksz8463 specificities from the common ksz8_config_cpu_port(). Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-2-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: implement ksz8463_setup()Bastien Curutchet (Schneider Electric)
KSZ8463 uses the ksz8_setup() as setup() callback for its DSA operations. Its behavior is quite different than other KSZ8 switches, especially its interrupt scheme. Remove from the ksz8_setup()/ksz8_reset_switch() everything that is ksz8463-related. Create a dedicated ksz8463_setup() and a ksz8463_reset_switch() function. This new ksz8463_setup() is widely inspired from ksz8_setup, it has following differences: - it doesn't configure drive strength (not supported on KSZ8463) - it uses the ksz8463_reset_switch() - it doesn't call ksz8_handle_global_errata() (the handled errata only affects the KSZ87xx variant) - it doesn't configure IRQs. Note that ksz8_setup()'s IRQ initialization doesn't work for the KSZ8463 anyway. Proper support for it comes in upcoming patches. Remove the teardown implementation from the KSZ8463 operations. Since PTP and interrupts aren't setup, the common ksz_teardown() wouldn't do anything anyway. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-1-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31Merge tag 'drm-fixes-2026-08-01' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm fixes from Dave Airlie: "Weekly pulls request. As expected there is more AMD this week since Alex was off last week, vmwgfx looks to have been hit with the AI stick a bit and mediatek as well. Otherwise some minor fixes across the board, the new normal definitely seems to be a thing. dp: - Restrict some DP bandwidth calculations to HDMI DFP bridge: - Fix small leak in bridge/display-connector mediatek: - Check CRTC state before freeing - mtk_hdmi: Fix DDC adapter double put in v2 - mtk_hdmi_common: take i2c adapter module reference - mtk_dsi: Enable HS clock only at pre-enable - ovl_adaptor: balance component registrations amdgpu: - VCN 5.3 fix - UserQ fixes - GEM close optimization - HDMI AV mute fix - UML build fixes - GFXOFF residency metrics fixes - SMU 15 fixes - debug_vm fix - PSP 15 fixes - NBIO 7.11.5 fix - pptable use after free fix - gpu metrics fetch fix - DC viewport fix - DML2.1 fix - i2c retimer spam fix - UMD profile pstate fix - Power metrics format cleanup - GTT size fix on APUs - DC context logging fix - PM sysfs fix for APUs - Follow on pageflip timeout fix amdkfd: - Various bounds checking fixes - Mutex locking fix i915/xe: - Check no-DMA huge-pte cases before DMA segment test - sink FRL rate fix - 200ms fix for TMDS scrambler status vmwgfx: - Improve various size checks and limit checks - Fix oops when submitting invalid execbuf ioctl - Correctly lock in vmfwgx fence signaling path - More validation of execbuf ioctl - Fix oops in vmwgfx vkms init failure path - Overflow handling in shader path panthor: - Improve firmware validation imagination: - Improve imagination trace points. qaic: - Fix QAIC transaction length check" * tag 'drm-fixes-2026-08-01' of https://gitlab.freedesktop.org/drm/kernel: (59 commits) drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status drm/amd/display: Exit idle optimizations before programming drm/amd/pm: hide pp_table sysfs on APUs accel/qaic: use sizeof(*trans_hdr) for transaction length check drm/panthor: validate firmware interface structure sizes drm/xe/pt: check no-DMA huge-pte cases before DMA segment test drm/imagination: Update the trace point pvr_job_submit_fw() drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder drm/mediatek: ovl_adaptor: balance component registrations drm/mediatek: mtk_dsi: Enable HS clock only at pre-enable drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs drm/amd/display: use proper context for logging drm/amdgpu: cap GTT size to physical RAM on APUs drm/amd/pm: use milliwatts for GPU power sensors drm/amdgpu: restore UMD profile pstate after runtime resume drm/amd/display: Silence link_dpms I2C retimer failures drm/amdkfd: hold event_mutex while checkpointing CRIU events drm/amd/display: check if dml21_add_phantom_plane() is successful drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport drm/amd/display: Add AV mute wait frames to dce110_set_avmute ...
2026-07-31PCI: host-common: Add link down handling for Root PortsManivannan Sadhasivam
The PCIe link, when down, needs to be recovered to bring it back. But on some platforms, that cannot be done in a generic way as link recovery procedure is platform specific. Add a new pci_host_handle_link_down() that could be called by the host bridge drivers for a specific Root Port when the link goes down. pci_host_handle_link_down() accepts a 'pci_dev' corresponding to the Root Port that observed the link down event. If CONFIG_PCIEAER is enabled, it calls pcie_do_recovery() with 'pci_channel_io_frozen' as the state. This will result in the execution of the AER Fatal error handling code. Since the link down recovery is pretty much the same as AER Fatal error handling, reuse pcie_do_recovery() here. The AER .error_detected() callback will be triggered for all of the downstream devices, but not for the Root Port itself as there is nothing to do for the Root Ports in the callbacks. Finally, pci_host_reset_root_port() will be called for the Root Port, which will reset the Root Port using the .reset_root_port() callback to recover the link. Once that's done, resume message will be broadcasted to the bridge and the downstream devices, indicating successful link recovery. But if CONFIG_PCIEAER is not enabled in the kernel, only pci_host_reset_root_port() will be called, which will in turn call pci_bus_error_reset() to just reset the Root Port as there is no way we could inform the drivers about link recovery. Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Brian Norris <briannorris@chromium.org> Tested-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Tested-by: Richard Zhu <hongxing.zhu@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260729-pci-port-reset-v9-3-53570b92064d@oss.qualcomm.com
2026-08-01Revert "pinctrl: s32cc: implement GPIO functionality"Linus Walleij
This reverts commit 94cb9e8f270797e489633cfa53d2d44afecb8bef. This collides with orthogonal changes in the GPIO tree, we need to rebase it and apply it to the GPIO tree instead. Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-31power: supply: max17040: drop incorrect I2C functionality checkJianing Li
max17040_probe() rejects adapters that do not advertise I2C_FUNC_SMBUS_BYTE. The driver does not issue SMBus byte transactions, however. Its regmap has 8-bit registers and 16-bit big-endian values, for which regmap-i2c supports either raw I2C transfers or SMBus word-data transactions. Consequently, an adapter providing raw I2C transfers or SMBus word data but not SMBus byte transactions is rejected even though regmap can access the device. Conversely, the current check can pass an adapter that regmap cannot use. Drop the stale check and let devm_regmap_init_i2c() validate and select the supported transfer method. Fixes: 6455a8a84bdfd ("power: supply: max17040: Use regmap i2c") Cc: stable@vger.kernel.org Signed-off-by: Jianing Li <m13940358460@163.com> Link: https://patch.msgid.link/20260731084259.916-1-m13940358460@163.com [Fixed Fixes tag, so that it points to the regmap introduction instead of the initial driver addition] Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-01Merge tag 'drm-xe-next-2026-07-30' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next - Wait on external BO kernel fences in exec IOCTL (Brost) - General clean-up (Anas) - Documentation fix (Rafael) - Add a debugfs for pcode information (Karthik) - Free madvise VMA array on L2 flush failure (Guangshuo) - Page Table related fixes (Shuicheng, Zongyao) - Improvements GuC error handling and GuC small fixes (Sk, Zhanjun, Arvind) - Add new W/As (Daniele, Harish) - GuC paging engine support (Auld) - Add and use more KLV helpers (Michal) - Balance exec queue suspend/resume (Niranjana, Thomas) - Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC (Himal) - SRIOV: Disable display in admin only PF mode (Satya) - Fix writable override for CRI NVM (Sasha) - Fix VF CCS attach/detach race with in-flight BO moves (Brost) - Introduce Xe Uncorrectable Error Handling (Riana) - Fix WOPCM size for LNL+ (Daniele) - Consolidate debugfs fault injection functions (Mallesh) - Multi-queue related fixes and improvements (Niranjana, Jagmeet, Shuicheng) - Add RAS GPU health indicator (Soham) - PAT related improvements (Roper, Sanjay) - NULL deref fix on migration on VF (Satya) - i2c related fix (Raag) - Fix SVM leak and clean up xe_vm_create (Shuicheng) - Drop force_probe requirement for NVL-s (Gustavo) - Optimise TT population for DONTNEED BOs (Auld) - Add page size allocation mode control and coverage (Himal, Nareshkumar) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/amt2kDVdyBK6VEyU@intel.com
2026-07-31Merge tag 'devicetree-fixes-for-7.2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix NULL bus dereference in of_pci_range_parser_one() - Prevent out-of-bounds access when too many dynamic reserved memory regions are defined * tag 'devicetree-fixes-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of/address: Fix NULL bus dereference in of_pci_range_parser_one() of: reserved_mem: prevent OOB when too many dynamic regions are defined
2026-07-31Merge tag 'hyperv-fixes-signed-20260731' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyper-v fixes from Wei Liu: - Multiple fixes for the MSHV driver (Stanislav Kinsburskii, Wei Liu, Yi Xie, Yousef Alhouseen) - Multiple fixes for the VMBus driver (Hardik Garg, Michael Kelley, Sebastian Andrzej Siewior) * tag 'hyperv-fixes-signed-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: mshv_vtl: bounds-check cpu index in vtl mmap fault handler mshv: Publish VP to pt_vp_array before installing the file descriptor Drivers: hv: vmbus: add VTL2 redirect connection ID mshv: Order pt_vp_array publish against irqfd assertion path mshv: Fix missing error code on VP allocation failure mshv: Fix level-triggered check on uninitialized data mshv: Fix race in mshv_irqfd_deassign mshv: Use kfree_rcu in mshv_portid_free mshv: Fix sleeping under spinlock in mshv_portid_alloc mshv: Fix duplicate GSI detection for GSI 0 Drivers: hv: vmbus: Remove vmbus_irq_initialized Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation mshv_vtl: fix fd leak in mshv_ioctl_create_vtl() mshv_vtl: clear hypercall output before copyout Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices mshv: fix hv_input_get_system_property struct
2026-07-31spi: ma35d1-qspi: Add Nuvoton MA35D1 QSPI controllerMark Brown
Chi-Wen Weng <cwweng.linux@gmail.com> says: Add devicetree binding and SPI controller driver support for the Quad SPI controller found in Nuvoton MA35D1 SoCs. The controller provides two native chip selects and supports standard SPI and spi-mem operations using single, dual and quad bus widths. This initial implementation uses 8-bit PIO transfers and supports per-operation clock configuration, clock and reset handling, and direct execution of SPI memory operations. DMA and active-high chip select support are intentionally left out of the initial driver. Link: https://patch.msgid.link/20260731023818.1626075-1-cwweng.linux@gmail.com
2026-07-31spi: ma35d1-qspi: Add Nuvoton MA35D1 QSPI controller supportChi-Wen Weng
Add SPI controller driver support for the Quad SPI controller found in Nuvoton MA35D1 SoCs. The controller provides two native chip selects and supports standard SPI and spi-mem operations, including single-bit full-duplex transfers and dual or quad half-duplex transfers. Implement 8-bit PIO transfers, per-operation clock configuration, clock and reset handling, and direct execution of SPI memory operations. Limit individual transfers to 4 KiB and SPI messages to 8 KiB to keep the PIO polling path bounded. Read the optional num-cs property and fall back to the hardware default of two chip selects when it is not present. Active-high chip select and DMA transfers are not supported by this initial implementation. Signed-off-by: Chi-Wen Weng <cwweng@nuvoton.com> Link: https://patch.msgid.link/20260731023818.1626075-3-cwweng.linux@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01Merge tag 'drm-intel-next-2026-07-28' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-next drm/i915 feature pull #2 for v7.3: Features and functionality: - Enable UHBR link rates on Thunderbolt tunneled links (Imre) - Reduce Xe3+ PM demand peak bandwidth for power savings (Vinod) - Add the blend mode property to all planes that support alpha blending (Chaitanya) - Enable pipe DMC error interrupts for display 30+ (Dibin) - Add KUnit tests for DP link config selection and fallback (Imre) Refactoring and cleanups: - Refactor DP link config selection and unify across use cases (Imre) - Unify i915 and xe display runtime PM calls (Jani) - Refactor BIOS framebuffer takeover (Ville) Fixes: - Fix HD audio on DP UHBR SST (Kai Vehmanen) - Fixes to xe driver BIOS framebuffer takeover (Ville) - Fix 2 pixels-per-clock CDCLK calculation to avoid underruns (Ville) - Fix incorrectly set VSC SDP Main Stream Attribute (Chaitanya) - Fix BPC and DSC selection for HDMI sinks (Alexander Kaplan) - Fix PCON max FRL rate selection (Alexander Kaplan) - Workaround Xe3P PSR2 screen corruption (Dibin) - Fix NVL A & B stepping vtotal setting (Suraj) - Fix xe DPT allocation paths (Maarten) - Prefer system memory instead of stolen for new framebuffers in xe (Maarten) - Fix transcoder mask sizes (John Harrison) - Clear stale UV/Y plane DDB entries on plane disable (Vinod) - Fix some DP AUX backlight control issues, again (Suraj) - Fix switching between HDCP 1.4 and 2.2 authentication (Suraj) - Remove unnecessary Xe2_LPD+ FBC plane width and surface size limits (Vinod) - Ensure non-zero DSB safe window for PTL+ (Ankit) - Fix bandwidth calculation to account for 16 DRAM channels (Uma) - Fix NV12 ceiling division for bigjoiner case (Vidya) DRM core changes: - Add Thunderbolt UHBR tunneling support (Imre) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/cb1b5a644d75589cbcdcc8ec8160968140426439@intel.com
2026-07-31mshv_vtl: bounds-check cpu index in vtl mmap fault handlerYi Xie
cpu is taken from pgoff & 0xffff. cpu_online() does not reject cpu >= nr_cpu_ids, and per_cpu_ptr() can then walk off __per_cpu_offset. Signed-off-by: Yi Xie <xieyi@kylinos.cn> Reviewed-by: Naman Jain <namjain@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31mshv: Publish VP to pt_vp_array before installing the file descriptorStanislav Kinsburskii
mshv_partition_ioctl_create_vp() called anon_inode_getfd() before publishing the new VP into partition->pt_vp_array. anon_inode_getfd() includes fd_install(), so the fd was live in current->files before the publish ran. A concurrent MSHV_RUN_VP ioctl on that fd does not serialise against the in-progress MSHV_CREATE_VP — it takes vp->vp_mutex, not the partition mutex. Once the VP starts running and traps, mshv_intercept_isr() can look up partition->pt_vp_array[vp_index] and observe NULL, silently dropping the intercept message. Split the fd creation: reserve an fd with get_unused_fd_flags(), create the file with anon_inode_getfile(), publish the VP via smp_store_release(), and finally call fd_install() as the userspace-visibility commit point. Fixes: 621191d709b14 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31Drivers: hv: vmbus: add VTL2 redirect connection IDHardik Garg
VMBus sends CHANNELMSG_INITIATE_CONTACT through a Hyper-V message connection ID. Older protocol versions use VMBUS_MESSAGE_CONNECTION_ID, while protocol version 5.0 and newer normally use VMBUS_MESSAGE_CONNECTION_ID_4. For a VTL2 kernel using VMBus protocol 5.0 or newer, the host may expect INITIATE_CONTACT on either the redirect connection ID or VMBUS_MESSAGE_CONNECTION_ID_4. There is no capability indication that identifies which ID is active, so the driver must determine it at runtime. During VMBus negotiation, the redirect ID is tried first because it is used by VTL2 configurations with VMBus redirection enabled. If the redirect ID is unavailable, the host rejects it synchronously with HV_STATUS_INVALID_CONNECTION_ID, allowing fallback to the standard ID. Return a distinct error for an invalid Initiate Contact connection ID so this fallback does not mask other post-message failures or protocol-version rejections. Preserve the existing connection ID selection for older protocol versions or when running below VTL2. Signed-off-by: Hardik Garg <hargar@linux.microsoft.com> Reviewed-by: Tianyu Lan <Tianyu.Lan@microsoft.com> Reviewed-by: Saurabh Sengar <ssengar@linux.microsoft.com> Reviewed-by: Naman Jain <namjain@linux.microsoft.com> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31mshv: Order pt_vp_array publish against irqfd assertion pathStanislav Kinsburskii
mshv_partition_ioctl_create_vp() initialises a VP struct (allocations, mutex_init, init_waitqueue_head, page mappings) and then publishes the pointer into partition->pt_vp_array. Several ISR paths read this array locklessly: the intercept ISR, the two scheduler ISRs, and mshv_try_assert_irq_fast() on the irqfd fast path. Of these, only mshv_try_assert_irq_fast() can structurally race the publish. It runs from an eventfd waker without holding pt_mutex, and MSHV_IRQFD does not require the target lapic_apic_id (== vp_index) to refer to an existing VP at registration time. A user can therefore register an irqfd targeting a yet-to-be-created VP, then trigger mshv_try_assert_irq_fast() concurrently with MSHV_CREATE_VP for the same index. On weakly-ordered architectures the reader can observe a non-NULL pointer in pt_vp_array before the initialising stores to the VP struct become visible, leading to use of partially-initialised fields (e.g. vp_register_page). The other ISR readers cannot reach this race: the hypervisor will not generate intercept or scheduler messages for a VP that has never been told to run, and the user can only call MSHV_RUN_VP on the VP fd returned by MSHV_CREATE_VP, which by construction is returned after the publish. Leave those readers as plain loads. Use smp_store_release() in mshv_partition_ioctl_create_vp() to publish the pointer, and pair it with smp_load_acquire() in mshv_try_assert_irq_fast(). On x86 these compile to plain accesses under TSO; on ARM64 they emit one-instruction acquire/release barriers, acceptable on this fast path. The destroy-side path (destroy_partition() clearing pt_vp_array[i] to NULL after kfree(vp)) has a separate ordering and lifetime concern that is out of scope here. Fixes: 621191d709b14 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31mshv: Fix missing error code on VP allocation failureStanislav Kinsburskii
In mshv_partition_ioctl_create_vp(), when kzalloc for the VP struct fails, the code jumps to the cleanup path without setting ret. At that point ret is 0 from the preceding successful mshv_vp_stats_map() call, so the function returns success to userspace despite having failed to create the VP. No fd is installed and no VP is registered in pt_vp_array, but userspace has no way to know the operation failed. Set ret to -ENOMEM before jumping to the cleanup path. Fixes: 621191d709b14 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31mshv: Fix level-triggered check on uninitialized dataStanislav Kinsburskii
In mshv_irqfd_assign(), the level-triggered validation for resample irqfds checks irqfd_lapic_irq.lapic_control.level_triggered before mshv_irqfd_update() has populated the field. Since the irqfd struct is zero-allocated, level_triggered is always 0 at that point, causing the check to always reject resample irqfds with -EINVAL. This makes level-triggered interrupt resampling — used to avoid interrupt storms with assigned devices — completely non-functional. Move the check after the mshv_irqfd_update() call, which resolves the IRQ routing entry and populates irqfd_lapic_irq with the actual trigger mode. Fixes: 621191d709b14 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31mshv: Fix race in mshv_irqfd_deassignStanislav Kinsburskii
mshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list require pt->pt_irqfds_lock to be held, but mshv_irqfd_deassign() omits it. This races with the EPOLLHUP path in mshv_irqfd_wakeup(), which does take the lock before calling mshv_irqfd_deactivate(). Additionally, mshv_irqfd_deactivate() uses hlist_del() which poisons the node pointers rather than resetting them. Since mshv_irqfd_is_active() relies on hlist_unhashed() (checks pprev == NULL), a poisoned node still appears active. If a concurrent path calls mshv_irqfd_deactivate() again on the same irqfd, the guard fails to prevent a double hlist_del() on poisoned pointers. Fix both issues: - Add the missing spin_lock_irq/spin_unlock_irq around the list traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release(). - Use hlist_del_init() instead of hlist_del() so the node is properly marked as unhashed after removal, making the is_active guard reliable. Fixes: 621191d709b14 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31mshv: Use kfree_rcu in mshv_portid_freeStanislav Kinsburskii
mshv_portid_free() uses synchronize_rcu() followed by kfree() to reclaim port table entries. This blocks the caller until a full RCU grace period elapses, which is unnecessary since the same module already uses the non-blocking kfree_rcu() pattern in mshv_port_table_fini(). Replace with kfree_rcu() to avoid the blocking wait and keep the reclamation strategy consistent across the file. Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-07-31Merge tag 'spi-fix-v7.2-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "The drip of driver specific fixes, mostly from the device vendors themselves, keeps on coming in. There's more than I'd like right now but equally nothing hugely alarming" * tag 'spi-fix-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-nxp-fspi: propagate clock reconfig failures in nxp_fspi_select_mem() spi: spi-nxp-fspi: enter stop mode before reconfiguring MCR0 and DLL spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs spi: spi-qpic-snand: write the feature value before executing SET_FEATURE spi: spi-cadence: Move TX FIFO full busy-wait into FIFO spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure spi: spacemit: prepare both DMA descriptors before submitting
2026-07-31accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()Lizhi Hou
Two error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma) before returning an error code to the caller. This is incorrect: amdxdna_gem_obj_mmap() registers an HMM interval notifier before calling amdxdna_insert_pages(), and on a hard error it jumps to hmm_unreg to undo that registration. Calling vm_ops->close() manually — which drops the shmem pages_pin_count and the GEM object reference that backs the VMA — before the mmap syscall has even returned causes those resources to be released while the VMA is still alive. The kernel VMA teardown will call vm_ops->close() a second time when the process later unmaps the range, producing a reference count underflow. Replace both hard-error returns with a deferred-fault approach that keeps the VMA alive and retries page insertion through the HMM range-fault path. Fixes: e486147c912f ("accel/amdxdna: Add BO import and export") Reviewed-by: Max Zhen <max.zhen@amd.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260723074256.2435143-1-lizhi.hou@amd.com
2026-07-31regulator: fp9931: Fix VPOS/VNEG voltage selector tableRobby Cai
The VPOSNEG_table[] mapping does not match the FP9931 datasheet. The datasheet defines the VPOS/VNEG voltage mapping as: 00h-04h -> 7.04V (-7.04V) 05h -> 7.26V (-7.26V) 06h -> 7.49V (-7.49V) ... 28h-3Fh -> 15.06V (-15.06V) However, VPOSNEG_table[] has two issues: 1. Selector 0x00~0x04 should all map to 7.04V (5 entries), but the table has 6 entries of 7.04V, causing all subsequent entries to be shifted by one position. 2. Selectors 0x29~0x3F should all clamp to 15.06V (23 entries), but the table has only 41 entries. Any selector value above 0x28 would result in an out-of-bounds table access. Fix both issues by removing the duplicate 7.04V entry and appending the missing 23 clamped 15.06V entries, bringing the table to the correct size of 64 entries (0x00~0x3F). Fixes: 12d821bd13d4 ("regulator: Add FP9931/JD9930 driver") Signed-off-by: Robby Cai <robby.cai@nxp.com> Link: https://patch.msgid.link/20260724103441.800522-2-robby.cai@oss.nxp.com Signed-off-by: Mark Brown <broonie@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-08 07:12:08 +0000