summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-05-18dio: Use tabs and avoid continuation logging in dio_initThorsten Blum
Indent multiple lines using tabs instead of spaces. Use pr_info() and avoid continuation logging. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Link: https://patch.msgid.link/20260504081804.3260-5-thorsten.blum@linux.dev [geert: Correct format specifier for u8 dev->ipl] Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2026-05-18dio: Replace deprecated strcpy with strscpy in dio_initThorsten Blum
strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. While the current code works correctly, replace strcpy() with the safer strscpy() to follow secure coding best practices. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Link: https://patch.msgid.link/20260504081804.3260-3-thorsten.blum@linux.dev Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2026-05-18nubus: Switch to dynamic root deviceJohan Hovold
Driver core expects devices to be dynamically allocated and will, for example, complain loudly if a device that lacks a release function is ever freed. Use root_device_register() to allocate and register the root device instead of open coding using a static device. Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Finn Thain <fthain@linux-m68k.org> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Link: https://patch.msgid.link/20260424104011.2616970-1-johan@kernel.org Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2026-05-18gpio: tegra186: Add support for Tegra238Prathamesh Shete
Extend the existing Tegra186 GPIO controller driver with support for the GPIO controller found on Tegra238. Signed-off-by: Prathamesh Shete <pshete@nvidia.com> Link: https://patch.msgid.link/20260514124835.108532-2-pshete@nvidia.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-18accel: ethosu: Validate SRAM size on submitRob Herring (Arm)
Regions with a BO are checked against the BO size, but the SRAM region is not. The SRAM region doesn't have a BO, but the command stream region size should be checked against the SRAM size. The job's "sram_size" isn't useful here because an evil userspace could lie about the size. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Link: https://lore.kernel.org/r/20260513185434.1667045-1-robh@kernel.org Signed-off-by: Tomeu Vizoso <tomeu@tomeuvizoso.net> Reviewed-by: Tomeu Vizoso <tomeu@tomeuvizoso.net>
2026-05-18Merge branch 'linus' into timers/clocksourceThomas Gleixner
... to bring it up to date for new changes.
2026-05-18RDMA/cma: Constify struct configfs_item_operations and configfs_group_operationsChristophe JAILLET
'struct configfs_item_operations' and 'configfs_group_operations' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 6677 2776 64 9517 252d drivers/infiniband/core/cma_configfs.o After: ===== text data bss dec hex filename 6901 2552 64 9517 252d drivers/infiniband/core/cma_configfs.o Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Link: https://patch.msgid.link/6acd9c8a79b868b5e541a7e080a6b4b145e4fd4f.1778923041.git.christophe.jaillet@wanadoo.fr Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA: Replace memset with = {} pattern for ib_respond_udata()Jason Gunthorpe
Most drivers do this already, but some open-code a memset. Switch all instances found. qedr_copy_qp_uresp() is already called with zeroed memory so that memset is redundant. Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA: Add missed = {} initialization to uresp structsJason Gunthorpe
All of these are fully initialized so no bugs are being fixed. Add the missing initializer as a precaution against future changes. Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA: Use proper driver data response structs instead of open codingJason Gunthorpe
At some point the response structs were added and rdma-core is using them, but the kernel was not changed to use them as well. Replace the open-coded copy with the right struct and ib_respond_udata(). Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/mlx: Replace response_len with ib_respond_udata()Jason Gunthorpe
The Mellanox drivers have a pattern where they compute the response length they think they need based on what the user asked for, then blindly write that ignoring the provided size limit on the response structure. Drop this and just use ib_respond_udata() which caps the response struct to the user's memory, which is fine for what mlx5 is doing. Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/qedr: Replace qedr_ib_copy_to_udata() with ib_respond_udata()Jason Gunthorpe
This is another instance of the min() pattern. Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/cxgb4: Convert to ib_respond_udata()Jason Gunthorpe
These cases carefully work around 32-bit unpadded structures, but the min integrated into ib_respond_udata() handles this automatically. Zero-initialize data that would not have been copied. Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA: Convert drivers using sizeof() to ib_respond_udata()Jason Gunthorpe
Convert the pattern: ib_copy_to_udata(udata, &resp, sizeof(resp)); Using Coccinelle: @@ identifier resp; expression udata; @@ - ib_copy_to_udata(udata, &resp, sizeof(resp)) + ib_respond_udata(udata, resp) Run another pass with AI to propagate the return code correctly and remove redundant prints. Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA: Convert drivers using min to ib_respond_udata()Jason Gunthorpe
Convert the pattern: ib_copy_to_udata(udata, &resp, min(sizeof(resp), udata->outlen)); Using Coccinelle: @@ identifier resp; expression udata; @@ - ib_copy_to_udata(udata, &resp, min(sizeof(resp), udata->outlen)) + ib_respond_udata(udata, resp) @@ identifier resp; expression udata; @@ - ib_copy_to_udata(udata, &resp, min(udata->outlen, sizeof(resp))) + ib_respond_udata(udata, resp) Run another pass with AI to propagate the return code correctly and remove redundant prints. Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18IB/rdmavt: Don't abuse udata and ib_respond_udata()Jason Gunthorpe
Use copy_to_user() directly since the data is not being placed in the udata response memory. It is unclear why this is trying to do two copies, but leave it alone. Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA: Use ib_is_udata_in_empty() for places calling ib_is_udata_cleared()Jason Gunthorpe
Convert the pattern: if (udata->inlen && !ib_is_udata_cleared(udata, 0, udata->inlen)) Using Coccinelle: virtual patch virtual context virtual report @@ expression udata; @@ ( - udata->inlen && !ib_is_udata_cleared(udata, 0, udata->inlen) + !ib_is_udata_in_empty(udata) | - udata->inlen > 0 && !ib_is_udata_cleared(udata, 0, udata->inlen) + !ib_is_udata_in_empty(udata) ) @@ expression udata; @@ - udata && udata->inlen && !ib_is_udata_cleared(udata, 0, udata->inlen) + !ib_is_udata_in_empty(udata) These cases are already checking for zeroed data that the kernel does not understand. Run another pass with AI to propagate the return code correctly and remove redundant prints. Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/hns: Use named initializer for pci_device_id arrayUwe Kleine-König (The Capable Hub)
While being more verbose using a named initializer yields easier to understand code and doesn't rely on the two hidden zeros in the PCI_VDEVICE macro. While at it, also drop the explicit zero in the terminating entry. This doesn't introduce any changes to the compiled result of the array, which was confirmed on x86 and arm64. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20260507075437.2669363-2-u.kleine-koenig@baylibre.com Reviewed-by: Junxian Huang <huangjunxian6@hisilicon.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/siw: use kzalloc_flexBernard Metzler
Simplify umem allocation by using flexible array member. Add __counted_by to get extra runtime analysis. Suggested-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Bernard Metzler <bernard.metzler@linux.dev> Link: https://patch.msgid.link/20260511141149.52362-1-bernard.metzler@linux.dev Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/bng_re: Remove unused variable rcRohit Chavan
The variable 'rc' is initialized to 0 and returned at the end of bng_re_process_qp_event(), but it is never modified in between. Simplify the function by removing the redundant variable and returning 0 directly. This cleans up the code and avoids potential compiler warnings about unused variables. Signed-off-by: Rohit Chavan <roheetchavan@gmail.com> Link: https://patch.msgid.link/20260505085709.1755534-1-roheetchavan@gmail.com Reviewed-by: Siva Reddy Kallam <siva.kallam@broadcom.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/hns: Support congestion control algorithm parameter configurationChengchang Tang
hns RoCE supports 4 congestion control algorithms. Each algorihm involves multiple parameters. Support configuring these parameters by debugfs. Here are some examples of this feature: * The directory structure: $ ls /sys/kernel/debug/hns_roce/0000\:35\:00.0/ dcqcn_cc_param dip_cc_param hc3_cc_param ldcp_cc_param $ ls /sys/kernel/debug/hns_roce/0000\:35\:00.0/dcqcn_cc_param/ ai al alp ashift cnp_time f g lifespan max_speed tkp tmp * Read the value of a param: $ cat /sys/kernel/debug/hns_roce/0000\:35\:00.0/dcqcn_cc_param/ai 1 * Set a new value for a param: $ echo 2 > /sys/kernel/debug/hns_roce/0000\:35\:00.0/dcqcn_cc_param/ai Signed-off-by: Chengchang Tang <tangchengchang@huawei.com> Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com> Link: https://patch.msgid.link/20260507012148.1079712-4-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/hns: Add write support to debugfsJunxian Huang
Add write support to debugfs. Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com> Link: https://patch.msgid.link/20260507012148.1079712-3-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/hns: Initialize seqfile before creating fileJunxian Huang
The debugfs file was created before seq->read and seq->data were set, leaving a small window where userspace could access an uninitialized seqfile. Move debugfs_create_file() after the assignments to avoid this issue. Also, inline the original init_debugfs_seqfile() since it is not a really necessary helper. Fixes: ca7ad04cd5d2 ("RDMA/hns: Add debugfs to hns RoCE") Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com> Link: https://patch.msgid.link/20260507012148.1079712-2-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/mlx5: Use max() macro for bfreg calculationRohit Chavan
Simplify the calculation of medium blue flame registers by using the max() macro instead of open-coded ternary logic. This improves readability and aligns with the subsystem's preference for using standard kernel helpers. Signed-off-by: Rohit Chavan <roheetchavan@gmail.com> Link: https://patch.msgid.link/20260505100550.1810139-1-roheetchavan@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/srpt: fix integer overflow in immediate data length checkSara Venkatesh
imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one(). Use check_add_overflow() to detect wrapping before the comparison. Fixes: 5dabcd0456d7 ("RDMA/srpt: Add support for immediate data") Reported-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org> Signed-off-by: Sara Venkatesh <sarajvenkatesh@gmail.com> Link: https://patch.msgid.link/20260504080036.3482415-1-sarajvenkatesh@gmail.com Reviewed-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/mlx4: Use secs_to_jiffies() instead of open-codingRohit Chavan
The conversion from seconds to jiffies is currently performed by multiplying the value by 1000 and passing it to msecs_to_jiffies(). Use the more direct secs_to_jiffies() helper instead. This simplifies the code, improves readability, and avoids the manual multiplication step by using the dedicated kernel API. Signed-off-by: Rohit Chavan <roheetchavan@gmail.com> Link: https://patch.msgid.link/20260505075308.1754861-1-roheetchavan@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18IB/mlx5: Reduce spinlock contention by moving free operations outsideLi RongQing
The functions kfree() and kvfree() can occasionally trigger a long chain of calls or face contention in the slab allocator. Executing these inside a spinlock increases the risk of CPU stalls and increases lock contention under heavy event load. Move the memory freeing logic out of the critical sections in devx.c by using temporary lists and local flags. This narrows the lock's scope to only protect the list integrity and state transitions. Signed-off-by: Li RongQing <lirongqing@baidu.com> Link: https://patch.msgid.link/20260503023349.1959-1-lirongqing@baidu.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/mlx5: Fix devx subscribe-event unwind NULL dereferencePrathamesh Deshpande
MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list before initializing the fields used by the shared error path. If eventfd_ctx_fdget() then fails, the unwind path dereferences event_sub->ev_file in uverbs_uobject_put() and calls subscribe_event_xa_dealloc() with an unset xa_key_level1. subscribe_event_xa_alloc() creates the XA entry exactly once for a given key_level1, on the first occurrence of that key. The unwind path must therefore call subscribe_event_xa_dealloc() exactly once for it as well. Enforce that by adding devx_key_in_sub_list() and calling subscribe_event_xa_dealloc() only when the last matching pending entry is being cleaned up. Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX") Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com> Link: https://patch.msgid.link/20260428224319.37682-1-prathameshdeshpande7@gmail.com Reviewed-by: Yishai Hadas <yishaih@nvidia.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failurePrathamesh Deshpande
mlx5r_umr_update_xlt() allocates and DMA maps an XLT buffer with mlx5r_umr_create_xlt(). The buffer is released by the common cleanup path through mlx5r_umr_unmap_free_xlt(). After mlx5_odp_populate_xlt() became fallible, its error path returned directly and skipped that cleanup. This leaks the XLT DMA mapping and buffer. If the emergency XLT page was used, it also leaves xlt_emergency_page_mutex locked. Break out of the loop so execution falls through the existing cleanup path. Fixes: 1efe8c0670d6 ("RDMA/core: Convert UMEM ODP DMA mapping to caching IOVA and page linkage") Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com> Link: https://patch.msgid.link/20260426132356.22264-1-prathameshdeshpande7@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/efa: Add checksum support for admin responsesYonatan Nachum
EFA devices added support for CRC16 checksum on admin responses and to expose it to the driver the API version increased to 0.2. Add a check for support on device init and if supported validate the checksum on each admin response the driver receives. If the checksum validation failed, drop the CQE. Add the CRC16 module to Kconfig to have the in-tree dependency. Reviewed-by: Firas Jahjah <firasj@amazon.com> Reviewed-by: Michael Margolin <mrgolin@amazon.com> Signed-off-by: Yonatan Nachum <ynachum@amazon.com> Link: https://patch.msgid.link/20260409074905.3126023-1-ynachum@amazon.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/rxe: support perf mgmt GET methodzhenwei pi
In RXE, hardware counters are already supported, but not in a standardized manner. For instance, user-space monitoring tools like atop only read from the *counters* directory. Therefore, it is necessary to add perf management support to RXE. Also use rxe_counter_get instead of raw atomic64_read in hw-counters. Signed-off-by: zhenwei pi <zhenwei.pi@linux.dev> Link: https://patch.msgid.link/20260414062948.671658-4-zhenwei.pi@linux.dev Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/rxe: add SENT/RCVD byteszhenwei pi
There is a lack of sent/received counter in bytes. Signed-off-by: zhenwei pi <zhenwei.pi@linux.dev> Link: https://patch.msgid.link/20260414062948.671658-3-zhenwei.pi@linux.dev Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/rxe: remove rxe_ib_device_get_netdev() and RXE_PORTzhenwei pi
Suggested by Leon, remove the rxe_ib_device_get_netdev() wrapper and the RXE_PORT definition. These additions do not improve readability, and RXE has always had only a single port. Signed-off-by: zhenwei pi <zhenwei.pi@linux.dev> Link: https://patch.msgid.link/20260414062948.671658-2-zhenwei.pi@linux.dev Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/hns: Fix arithmetic overflow in calc_hem_config()Alexander Chesnokov
If bt_num is 3 or 2, then the expressions like l0_idx * chunk_ba_num + l1_idx are computed in 32-bit arithmetic before being assigned to a u64 index field, which can lead to overflow. Cast the first operand to u64 to ensure the arithmetic is performed in 64-bit. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 2f49de21f3e9 ("RDMA/hns: Optimize mhop get flow for multi-hop addressing") Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com> Link: https://patch.msgid.link/20260413091527.39990-1-Alexander.Chesnokov@kaspersky.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18RDMA/mlx5: Use QP port when decoding responder CQEsChenguang Zhao
The responder CQE path determines the link layer via rdma_port_get_link_layer(). Use qp->port instead of hardcoding port 1, which can mis-decode completions on multi-port devices. Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn> Link: https://patch.msgid.link/20260410074046.2044595-1-zhaochenguang@kylinos.cn Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlierPrathamesh Deshpande
mlx5_ib_alloc_transport_domain() allocates a transport domain and then may fail in mlx5_ib_enable_lb(). In that case, the allocated TD is leaked. Fix this by deallocating the TD when mlx5_ib_enable_lb() returns an error. Also return 0 explicitly in the no-loopback-capability success branch, and move dev->lb.mutex initialization to mlx5_ib_stage_init_init(). Fixes: 146d2f1af324 ("IB/mlx5: Allocate a Transport Domain for each ucontext") Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-05-18gpio: Initialize i2c_device_id arrays using member namesUwe Kleine-König (The Capable Hub)
While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. The mentioned robustness is relevant for a planned change to struct i2c_device_id that replaces .driver_data by an anonymous union. This patch doesn't modify the compiled arrays, only their representation in source form benefits. The former was confirmed with x86 and arm64 builds. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20260512152125.924433-2-u.kleine-koenig@baylibre.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-18pwm: atmel-tcb: Remove unneeded semicolonChen Ni
Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. This was introduced in commit 68637b68afcc ("pwm: atmel-tcb: Cache clock rates and mark chip as atomic") in Uwe's adaption of Sangyun's original patch. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Link: https://patch.msgid.link/20260428075329.1234735-1-nichen@iscas.ac.cn Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-18pinctrl: intel: move PWM base computation past feature checkStepan Ionichev
Compute base inside intel_pinctrl_probe_pwm() only after the PINCTRL_FEATURE_PWM and CONFIG_PWM_LPSS checks have passed. Tidy up; no functional change. Suggested-by: Andy Shevchenko <andy@kernel.org> Link: https://lore.kernel.org/linux-gpio/aglu5jy5SbW9Wjwj@ashevche-desk.local/ Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com> Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2026-05-18soc: aspeed: Move MODULE_DEVICE_TABLE next to the table itselfKrzysztof Kozlowski
By convention MODULE_DEVICE_TABLE() immediately follows the ID table it exports, because this is easier to read and verify. It also makes more sense since #ifdef for ACPI or OF could hide both of them. Most of the privers already have this correctly placed, so adjust the missing ones. No functional impact. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
2026-05-18Merge tag 'i2c-host-fixes-7.1-rc4' of ↵Wolfram Sang
git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-host-fixes for v7.1-rc4 - tegra: - drop runtime PM reference when exiting on mutex_lock failure - preserve transfer errors when releasing the mutex
2026-05-18drm/i915/psr: Apply SDP on prior scanline workaround for Xe3pJouni Högander
In Xe3p there is an HW optimization done. When there is an SU triggered in Capture state, Link will be kept ON post Capture CRC SDP. Before valid SU pixels Intel source will transmit dummy pixels. Some TCONS are improperly considering these dummy pixels as a valid pixel data. Prior Xe3p link was was turned off even if there was SU triggered in capture state and no dummy pixels were transmitted. These dummy pixels are problem only if SDP on prior scanline is used and Early Transport is not in use. The workaround is to start SU area always at scanline 0. v2: use intel_display_wa Bspec: 74741, 79482 Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260515095756.2799483-5-jouni.hogander@intel.com
2026-05-18drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line usedJouni Högander
There is Intel specific workaround DPCD address containing workaround for case where SDP is on prior line. Apply this workaround according to values in the offset. Fixes: 61e887329e33 ("drm/i915/xelpd: Handle PSR2 SDP indication in the prior scanline") Cc: <stable@vger.kernel.org> # v5.15+ Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260515095756.2799483-4-jouni.hogander@intel.com
2026-05-18drm/i915/psr: Read Intel DPCD workaround registerJouni Högander
Read Intel DPCD workaround register and store it into intel_connector->dp.psr_caps. psr_caps was chosen as currently it contains only PSR workaround for PSR2 SDP on prior scanline implementation. Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260515095756.2799483-3-jouni.hogander@intel.com
2026-05-18drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD registerJouni Högander
EDP specification says: "If either VSC SDP is unable to be transmitted 100 ns before the SU region, the Source device may optionally transmit the VSC SDP during the prior video scan line’s HBlank period There is a Intel specific drm dp register currently containing bits related how TCON can support PSR2 with SDP on prior line." Unfortunately many panels are having problems in implementing this. So there is a custom Intel specific DPCD register (INTEL_WA_REGISTER_CAPS) to figure out if this is properly implemented on a panel or if panel doesn't require that 100 ns delay before the SU region. Here are the definitions in this custom DPCD address: 0 = Panel doesn't support SDP on prior line 1 = Panel supports SDP on prior line 2 = Panel doesn't have 100ns requirement 3 = Reserved Add definitions for this new register and it's values into new header intel_dpcd.h. v2: add INTEL_DPCD_ prefix to definitions Bspec: 74741 Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260515095756.2799483-2-jouni.hogander@intel.com
2026-05-18drm/i915/dp: Include all relevant AS SDP fields in comparisonAnkit Nautiyal
Add missing drm_dp_as_sdp header fields to intel_compare_dp_as_sdp() comparison. Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260511123218.1589830-5-ankit.k.nautiyal@intel.com
2026-05-18drm/i915/dp: Set sdp_type in AS SDP unpackAnkit Nautiyal
Add sdp_type in AS SDP unpack. Since the field sdp_type is not compared in intel_compare_dp_as_sdp() it doesn't throw up any mismatch error yet. In the subsequent change this field will be added along with other missing fields for comparison. Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260511123218.1589830-4-ankit.k.nautiyal@intel.com
2026-05-18drm/i915/dp: Use revision field of AS SDP data structureAnkit Nautiyal
Use the revision field of struct drm_dp_as_sdp instead of current hardcoding for the AS SDP revisions. Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260511123218.1589830-3-ankit.k.nautiyal@intel.com
2026-05-18drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDPAnkit Nautiyal
Correct the bit-shift logic to properly readback the 10 bit target_rr from DB3 and DB4. v2: Align the style with readback for vtotal. (Ville) Fixes: 12ea89291603 ("drm/i915/dp: Add Read/Write support for Adaptive Sync SDP") Cc: Mitul Golani <mitulkumar.ajitkumar.golani@intel.com> Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260511123218.1589830-2-ankit.k.nautiyal@intel.com
2026-05-17virt: sev-guest: Do not use host-controlled page order in cleanup pathCarlos López
When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST), get_ext_report() allocates a buffer to retrieve a certificate blob from the host, keeping track of its size in report_req->certs_len. However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating an invalid buffer size, as well as the expected length of such buffer. get_ext_report() subsequently updates report_req->certs_len with the host-controlled value, and cleans up the buffer by computing a page order from such value. This is incorrect, as the host-provided length may not match the page order of the original allocation, potentially resulting in corruption in the page allocator. Fix this by using alloc_pages_exact() instead, and reusing @npages to compute the size passed to free_pages_exact(). For consistency, also use @npages to compute the size when allocating the pages, even though this last change has no functional effect. Fixes: 3e385c0d6ce8 ("virt: sev-guest: Move SNP Guest Request data pages handling under snp_cmd_mutex") Signed-off-by: Carlos López <clopez@suse.de> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Tested-by: Michael Roth <michael.roth@amd.com> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-13 09:49:59 +0000