summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-05-05drm/gpuvm: rust: add RUST_DRM_GPUVM option to KconfigAlice Ryhl
Since Rust uses GPUVM via the kernel crate, which is built-in, the GPUVM module must also be built-in to use GPUVM from Rust. Adjust the Kconfig settings accordingly. Suggested-by: Danilo Krummrich <dakr@kernel.org> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Link: https://patch.msgid.link/20260427-gpuvm-config-v1-1-8ece03771f8a@google.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-05-05gpio: sim: add a Kconfig dependency on SYSFSBartosz Golaszewski
gpio-sim is unusable without sysfs. Add a Kconfig dependency to its entry. Closes: https://sashiko.dev/#/patchset/20260428113439.9783-1-m32285159%40gmail.com Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260429080312.15561-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-05drm/gpuvm: take refcount on DRM deviceAlice Ryhl
Currently GPUVM relies on the owner implicitly holding a refcount to the drm device, and it does not implicitly take a refcount on the drm device. This design is error-prone, so take a refcount on the device. Suggested-by: Danilo Krummrich <dakr@kernel.org> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Fixes: 546ca4d35dcc ("drm/gpuvm: convert WARN() to drm_WARN() variants") Link: https://patch.msgid.link/20260416-gpuvm-drm-dev-get-v1-1-f3bc06571e73@google.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-05-05media: cec: seco: unregister adapter on IR probe failureMyeonghun Pak
If secocec_ir_probe() fails after cec_register_adapter() succeeds, probe returns an error and the driver remove callback is not called. The current unwind path unregisters the notifier and then falls through to cec_delete_adapter(), which violates the CEC adapter lifetime rules after a successful registration. Add a registered-adapter unwind path that unregisters the notifier and the adapter instead. Fixes: daef95769b3a ("media: seco-cec: add Consumer-IR support") Cc: stable@vger.kernel.org Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: platform: cros-ec: Add Dirkson to the match tableKells Ping
The Google Dirkson device uses the same approach as the Google Brask which enables the HDMI CEC via the cros-ec-cec driver. Signed-off-by: Kells Ping <kells.ping@quanta.corp-partner.google.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05net: mana: remove double CQ cleanup in mana_create_rxq error pathDipayaan Roy
In mana_create_rxq(), the error cleanup path calls mana_destroy_rxq() followed by mana_deinit_cq(). This is incorrect for two reasons: 1. mana_destroy_rxq() already calls mana_deinit_cq() internally, so the CQ's GDMA queue is destroyed twice. 2. mana_destroy_rxq() frees the rxq via kfree(rxq) before returning. The subsequent mana_deinit_cq(apc, cq) then operates on freed memory since cq points to &rxq->rx_cq, which is embedded in the already-freed rxq structure — a use-after-free. Remove the redundant mana_deinit_cq() call from the error path since mana_destroy_rxq() already handles CQ cleanup. mana_deinit_cq() is itself safe for an uninitialized CQ as it checks for a NULL gdma_cq before proceeding. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Reviewed-by: Aditya Garg <gargaditya@linux.microsoft.com> Link: https://patch.msgid.link/20260430035935.1859220-4-dipayanroy@linux.microsoft.com Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-05net: mana: Skip WQ object destruction for uninitialized RXQDipayaan Roy
In mana_destroy_rxq(), mana_destroy_wq_obj() is called unconditionally even when the WQ object was never created (rxobj is still INVALID_MANA_HANDLE). When mana_create_rxq() fails before mana_create_wq_obj() succeeds, the error path calls mana_destroy_rxq() which sends a bogus destroy command to the hardware: mana 7870:00:00.0: HWC: Failed hw_channel req: 0x1d mana 7870:00:00.0: Failed to send mana message: -71, 0x1d mana 7870:00:00.0 eth7: Failed to destroy WQ object: -71 Guard mana_destroy_wq_obj() with an INVALID_MANA_HANDLE check so that mana_destroy_rxq() is safe to call at any stage of RXQ initialization. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Link: https://patch.msgid.link/20260430035935.1859220-3-dipayanroy@linux.microsoft.com Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-05net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()Dipayaan Roy
When mana_create_rxq() fails at mana_create_wq_obj() or any step before xdp_rxq_info_reg() is called, the error path jumps to `out:` which calls mana_destroy_rxq(). mana_destroy_rxq() unconditionally calls xdp_rxq_info_unreg() on xilinx xdp_rxq that was never registered, triggering a WARN_ON in net/core/xdp.c: mana 7870:00:00.0: HWC: Failed hw_channel req: 0xc000009a mana 7870:00:00.0 eth7: Failed to create RXQ: err = -71 Driver BUG WARNING: CPU: 442 PID: 491615 at ../net/core/xdp.c:150 xdp_rxq_info_unreg+0x44/0x70 Modules linked in: tcp_bbr xsk_diag udp_diag raw_diag unix_diag af_packet_diag netlink_diag nf_tables nfnetlink tcp_diag inet_diag binfmt_misc rpcsec_gss_krb5 nfsv3 nfs_acl auth_rpcgss nfsv4 dns_resolver nfs lockd ext4 grace crc16 iscsi_tcp mbcache fscache libiscsi_tcp jbd2 netfs rpcrdma af_packet sunrpc rdma_ucm ib_iser rdma_cm iw_cm iscsi_ibft ib_cm iscsi_boot_sysfs libiscsi rfkill scsi_transport_iscsi mana_ib ib_uverbs ib_core mana hyperv_drm(X) drm_shmem_helper intel_rapl_msr drm_kms_helper intel_rapl_common syscopyarea nls_iso8859_1 sysfillrect intel_uncore_frequency_common nls_cp437 vfat fat nfit sysimgblt libnvdimm hv_netvsc(X) hv_utils(X) fb_sys_fops hv_balloon(X) joydev fuse drm dm_mod configfs ip_tables x_tables xfs libcrc32c sd_mod nvme nvme_core nvme_common t10_pi crc64_rocksoft_generic crc64_rocksoft crc64 hid_generic serio_raw pci_hyperv(X) hv_storvsc(X) scsi_transport_fc hyperv_keyboard(X) hid_hyperv(X) pci_hyperv_intf(X) crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd hv_vmbus(X) softdog sg scsi_mod efivarfs Supported: Yes, External CPU: 442 PID: 491615 Comm: ethtool Kdump: loaded Tainted: G X 5.14.21-150500.55.136-default #1 SLE15-SP5 a627be1b53abbfd64ad16b2685e4308c52847f42 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 07/25/2025 RIP: 0010:xdp_rxq_info_unreg+0x44/0x70 Code: e8 91 fe ff ff c7 43 0c 02 00 00 00 48 c7 03 00 00 00 00 5b c3 cc cc cc cc e9 58 3a 1c 00 48 c7 c7 f6 5f 19 97 e8 5c a4 7e ff <0f> 0b 83 7b 0c 01 74 ca 48 c7 c7 d9 5f 19 97 e8 48 a4 7e ff 0f 0b RSP: 0018:ff3df6c8f7207818 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ff30d89f94808a80 RCX: 0000000000000027 RDX: 0000000000000000 RSI: 0000000000000002 RDI: ff30d94bdcca2908 RBP: 0000000000080000 R08: ffffffff98ed11a0 R09: ff3df6c8f72077a0 R10: dead000000000100 R11: 000000000000000a R12: 0000000000000000 R13: 0000000000002000 R14: 0000000000040000 R15: ff30d89f94800000 FS: 00007fe6d8432b80(0000) GS:ff30d94bdcc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe6d81a89b1 CR3: 00000b3b6d578001 CR4: 0000000000371ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 Call Trace: <TASK> mana_destroy_rxq+0x5b/0x2f0 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] mana_create_rxq.isra.55+0x3db/0x720 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] ? simple_lookup+0x36/0x50 ? current_time+0x42/0x80 ? __d_free_external+0x30/0x30 mana_alloc_queues+0x32a/0x470 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] ? _raw_spin_unlock+0xa/0x30 ? d_instantiate.part.29+0x2e/0x40 ? _raw_spin_unlock+0xa/0x30 ? debugfs_create_dir+0xe4/0x140 mana_attach+0x5c/0xf0 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] mana_set_ringparam+0xd5/0x1a0 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] ethnl_set_rings+0x292/0x320 genl_family_rcv_msg_doit.isra.15+0x11b/0x150 genl_rcv_msg+0xe3/0x1e0 ? rings_prepare_data+0x80/0x80 ? genl_family_rcv_msg_doit.isra.15+0x150/0x150 netlink_rcv_skb+0x50/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1b6/0x280 netlink_sendmsg+0x365/0x4d0 sock_sendmsg+0x5f/0x70 __sys_sendto+0x112/0x140 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x5b/0x80 ? handle_mm_fault+0xd7/0x290 ? do_user_addr_fault+0x2d8/0x740 ? exc_page_fault+0x67/0x150 entry_SYSCALL_64_after_hwframe+0x6b/0xd5 RIP: 0033:0x7fe6d8122f06 Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 72 f3 c3 41 57 41 56 4d 89 c7 41 55 41 54 41 RSP: 002b:00007fff2b66b068 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055771123d2a0 RCX: 00007fe6d8122f06 RDX: 0000000000000034 RSI: 000055771123d3b0 RDI: 0000000000000003 RBP: 00007fff2b66b100 R08: 00007fe6d8203360 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 000055771123d350 R13: 000055771123d340 R14: 0000000000000000 R15: 00007fff2b66b2b0 </TASK> Guard the xdp_rxq_info_unreg() call with xdp_rxq_info_is_reg() so that mana_destroy_rxq() is safe to call regardless of how far initialization progressed. Fixes: ed5356b53f07 ("net: mana: Add XDP support") Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Link: https://patch.msgid.link/20260430035935.1859220-2-dipayanroy@linux.microsoft.com Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-05drm/etnaviv: use kzalloc_flexRosen Penev
A local helper was developed previously for struct_size. kzalloc_flex can be used now. Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260320010757.32158-1-rosenp@gmail.com Signed-off-by: Christian Gmeiner <cgmeiner@igalia.com>
2026-05-05wifi: mac80211_hwsim: switch to use TXQsBenjamin Berg
Simply immediately TX all available packets on the corresponding queue. This removes the HWSIM_TM_CMD_STOP_QUEUES/HWSIM_TM_CMD_RESUME_QUEUES feature for now. It should be reasonably simple to add it back if it is needed. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260504101829.c590948c1e45.Id3e629770663c44de00faa3ff9bac9c6b87459c6@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-05wifi: mac80211_hwsim: refactor NAN timer handlingBenjamin Berg
Refactor the NAN timer to more closely track the where in the NAN schedule the device currently is. Do this by having an hrtimer that fires at the start of every slot. For now continue to update the current channel at the start of the DW. In the future, the correct channel according to the schedule should be used everywhere. This is in preparation to more accurately simulate more of the NAN logic. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260504101829.feb8e02b234e.I46da3cabea8624ba2e6c91bd2afecd2dc6553c5a@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-05wifi: mac80211_hwsim: register beacon timer by calculating TBTTBenjamin Berg
It is easy to calculate the next target beacon transmission time (TBTT) based on the current TSF and the beacon interval. Use this method to calculate the time to the next beacon. With this, the bcn_delta variable can be removed and drift over time due to the timer firing late is fully avoided. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260504101829.cc6f099ae2ac.Iccf6164f3feeb5350fcfe0df666248c686b226ae@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-05wifi: mac80211_hwsim: move timestamp writing later in the datapathBenjamin Berg
By delegating writing the timestamp into beacons and probe responses, we can remove the abs_bcn_ts from the global data and still avoid any time offset issues. This also seems conceptually closer to "real" hardware where the timestamp will be written late in the TX path. Move sending the SKB to the monitor interface to happen later, so that the frame timestamp has the value filled in by mac80211_hwsim. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260504101829.ad4d77d85e0d.I86810bbbf9b171acc6dbf07f9904ce1686b5167a@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-05wifi: mac80211_hwsim: rename and switch simulation time to boottimeBenjamin Berg
The mac80211_hwsim base time for the simulation of the TSF was based on the real time of the system. This clock is subject to unexpected changes. Switch it to use boottime which is always monotonic and also continues to run through times where the system is suspended. Also change the function name from tsf_raw to sim_tsf to better differentiate between the TSF of the mac and the TSF base of the simulation. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260504101829.2a64333111ff.I2ef047f3cdd6dc52af4bb7bf747368fb78014f18@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-05wifi: mac80211_hwsim: split NAN handling into separate fileBenjamin Berg
Having everything in one file for mac80211_hwsim is starting to get a lot and it will be even worse if we implement more parts of NAN. Split the NAN implementation into separate files to improve the code structuring. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260504101829.541371b35f02.I9484d746286eb2ab71ac987dfb907497d213c2bb@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-05wifi: mac80211_hwsim: move NAN related variables into a structBenjamin Berg
Move it all into a common struct to better segment the code. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260504101829.56feb1563479.Ia82f11ae5cbd0ac02b3697d010489d5a93906d40@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-05wifi: mac80211_hwsim: remove unused nan_vif struct memberBenjamin Berg
The struct also contains nan_device_vif and that is the member that is being used. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260504101829.b09e2428aa61.I35d3eae582461af7ee25c63c56b13adff17cf20f@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-05media: platform: cros-ec: Add Kulnex and Moxoe to the match tableKen Lin
The Google Kulnex and Moxoe device uses the same approach as Google Brask which enables the HDMI CEC via the cros-ec-cec driver. Signed-off-by: Ken Lin <kenlin5@quanta.corp-partner.google.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: mgb4: Fix DV timings limitsMartin Tůma
Provide the real DV timings limits in VIDIOC_DV_TIMINGS_CAP. For the outputs the pixelclock is limited by the CMT table <25000kHz, 2*94642kHz>, for the inputs a slightly broader range is possible. The minimal supported/tested resolution is 64px. Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05drm/panel: simple: Add Displaytech DT050BTFT-PTS panelMarek Vasut
Add support for the Displaytech DT050BTFT-PTS 5.0" (800x480) color TFT LCD panel, connected over DPI. Timings are taken from the datasheet from 16 Nov 2023 is available from Seacomp: https://www.seacomp.com/sites/default/files/datasheets/DT050BTFT-Displaytech-Spec.pdf Signed-off-by: Marek Vasut <marex@nabladev.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260422210806.80948-3-marex@nabladev.com
2026-05-05drm/panel: simple: Add Team Source Display TST070WSBE-196C panelWilliam Bright
Add a dedicated panel driver for the Team Source Display TST070WSBE-196C, a 7" 1024x600 MIPI-DSI TFT LCD panel using an EK79007AD controller. The DSI timings were calculated using "linux-mdss-dsi-panel-driver-generator" [1], reading the downstream file "dsi-panel-imdt-tst070wsbe165c-video.dtsi" [2]. [1] https://github.com/msm8916-mainline/linux-mdss-dsi-panel-driver-generator [2] https://raw.githubusercontent.com/imd-tec/meta-imdt-qcom/refs/heads/kirkstone/recipes-display/displaydevicetree/displaydevicetree/0001-Initial-bringup-of-IMDT-Display-3.patch Signed-off-by: William Bright <william.bright@imd-tec.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260428-imdt-dsi-display-v2-2-cf7294b5d7d6@imd-tec.com
2026-05-05drm/panel: Add panel driver for ChipWealth CH13726A based panelsTeguh Sobirin
This is used by the AYN Thor for the bottom panel. Signed-off-by: Teguh Sobirin <teguh@sobir.in> Co-developed-by: Aaron Kling <webgeek1234@gmail.com> Signed-off-by: Aaron Kling <webgeek1234@gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260426-ch13726a-v7-2-554247c569e5@gmail.com
2026-05-05drm/panel: simple: Add Startek KD070HDFLD092 LVDS panel supportStefan Kerkmann
The Startek KD070HDFLD092 is a 7" WSVGA LVDS panel. Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260407-panel-simple-startek-upstream-v1-2-76721696655f@pengutronix.de
2026-05-05wifi: libertas: notify firmware load wait on disconnectJakov Novak
Currently, when the firmware is not fully loaded and if_usb_disconnect is called, if_usb_prog_firmware gets stuck waiting for cardp->surprise_removed or cardp->fwdnldover while lbs_remove_card also waits for the firmware loading to be completed, which never happens. This caused the reported syzbot bug. To address this, the wake_up function call can be added in the if_usb_disconnect function which notifies the if_usb_prog_firmware thread and resolves the firmware loading. Fixes: 954ee164f4f4 ("[PATCH] libertas: reorganize and simplify init sequence") Reported-and-tested-by: syzbot+c99d17aa44dbdba16ad2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c99d17aa44dbdba16ad2 Signed-off-by: Jakov Novak <jakovnovak30@gmail.com> Link: https://patch.msgid.link/20260504162356.17250-2-jakovnovak30@gmail.com [fix subject] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-05drm/panel: Add driver for Novatek NT35532Cristian Cozzolino
Add support for Novatek NT35532-based 1080p video mode DSI panel. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Cristian Cozzolino <cristian_ci@protonmail.com> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260331-rimob-new-features-v5-2-5fcf42a29c12@protonmail.com
2026-05-05drm/etnaviv: Fix armed job not being pushed to the DRM schedulerMaíra Canal
When xa_alloc_cyclic() failed in etnaviv_sched_push_job(), the error path skipped drm_sched_entity_push_job(). This is a violation of the DRM scheduler contract, as once a job has been armed with drm_sched_job_arm(), it must be pushed with drm_sched_entity_push_job(). From the DRM scheduler documentation, """ drm_sched_job_arm() is a point of no return since it initializes the fences and their sequence number etc. Once that function has been called, you *must* submit it with drm_sched_entity_push_job() and cannot simply abort it by calling drm_sched_job_cleanup(). """ Fix this by splitting the fence ID allocation into two phases: first, alloc an xarray slot before arming the job (which can fail), then fill in the actual fence with xa_store() after arming. This way, allocation failures are handled before the job is armed, and once armed, the job is always pushed to the scheduler. This also fixes a double call to drm_sched_job_cleanup(), as both etnaviv_sched_push_job() and its caller would call it on failure. Fixes: 764be12345c3 ("drm/etnaviv: convert user fence tracking to XArray") Signed-off-by: Maíra Canal <mcanal@igalia.com> Link: https://patch.msgid.link/20260402193424.2023318-1-mcanal@igalia.com Signed-off-by: Christian Gmeiner <cgmeiner@igalia.com>
2026-05-05pinctrl: qcom: add the TLMM driver for the Nord platformsBartosz Golaszewski
Add support for the TLMM controller on the Qualcomm Nord platform. Co-developed-by: Shawn Guo <shengchao.guo@oss.qualcomm.com> Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Maulik Shah <maulik.shah@oss.qualcomm.com> Reviewed-by: Pankaj Patil <pankaj.patil@oss.qualcomm.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-05-05pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150Maulik Shah
PDC interrupts 122-125 were meant for ibi_i3c wakeup but sm8150 do not support i3c. GPIOs 39,51,88 and 144 are also connected to different PDC pin and already reflected in the wake irq map. Remove the unsupported wakeup interrupts from the map. Fixes: 90337380c809 ("pinctrl: qcom: sm8150: Specify PDC map") Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Maulik Shah <maulik.shah@oss.qualcomm.com> Signed-off-by: Navya Malempati <navya.malempati@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-05-05pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error pathFelix Gu
In the error path of sunxi_pmx_request(), the code calls regulator_put(s_reg->regulator) to release the regulator. However, s_reg->regulator is only assigned after a successful regulator_enable(). This causes a memory leak: the regulator obtained via regulator_get() is never properly released when regulator_enable() fails. Fixes: dc1445584177 ("pinctrl: sunxi: Fix and simplify pin bank regulator handling") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Reviewed-by: Andre Przywara <andre.przywara@arm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-05-05drm/tve200: Fix probe cleanup after register failureMyeonghun Pak
tve200_modeset_init() creates a panel bridge and initializes the DRM mode config before tve200_probe() registers the DRM device. If drm_dev_register() fails, probe returns an error and the driver's remove callback is not called, so those modeset resources are left behind. Unwind the panel bridge and mode config on that failure path before disabling the clock and dropping the DRM device reference. Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260424124118.38649-1-mhun512@gmail.com
2026-05-05auxdisplay: max6959: use regmap_assign_bits() in max6959_enable()Andy Shevchenko
Replace the ternary with a direct call to the regmap_assign_bits() helper and save a couple lines of code. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2026-05-05crypto: qat - fix heartbeat error injectionDamian Muszynski
The current implementation of the heartbeat error injection uses adf_disable_arb_thd() to stop a specific accelerator engine thread from processing requests. This does not reliably prevent the device from generating responses. Fix the error injection by disabling the device arbiter through exit_arb() instead. This properly simulates a device failure by stopping all arbitration, which results in missing responses for sent requests. Remove the now unused adf_disable_arb_thd() function and its declaration. Fixes: e2b67859ab6e ("crypto: qat - add heartbeat error simulator") Signed-off-by: Damian Muszynski <damian.muszynski@intel.com> Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-05-05s390/cio: Purge based on the cdev's online statusVineeth Vijayan
Ensure that all devices currently offline are purged correctly. Previously, purging logic relied on the internal FSM state to determine whether a device was offline. However, devices with a target state of offline could be skipped if CIO internal processing was still ongoing during the purge operation. Update the purge decision logic to rely on the online variable in the cdev structure instead of the internal FSM state, providing a more reliable indication of actual device availability. Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-05Merge patch series "scsi: ufs: Add persistent TX Equalization settings support"Martin K. Petersen
Can Guo <can.guo@oss.qualcomm.com> says: Hi, This series is a follow-up to the earlier TX Equalization enablement series: https://lore.kernel.org/all/20260325152154.1604082-1-can.guo@oss.qualcomm.com In that cover letter, the "Next" section mentioned adding support for UFS v5.0 Attributes qTxEQGnSettings and wTxEQGnSettingsExt, and enabling persistent storage/retrieval of optimal TX Equalization settings. This 2-patch series implements that part. Motivation ========== TX EQTR procedure is required to find the optimal TX Equalization settings for HS Gears (4-6) before changing Power Mode to the target HS Gears. However, TX EQTR procedure introduces latencies to the first Power Mode change. With optimal TX Equalization settings stored in UFS v5.0 Attributes qTxEQGnSettings and wTxEQGnSettingsExt, host software can reuse known-good settings and avoid going through the TX EQTR procedure. Array Attribute Model ===================== qTxEQGnSettings and wTxEQGnSettingsExt are array-type Attributes. Each element in an array-type Attribute is selected by an (Index, Selector) pair. For these two attributes: - Valid Index range: [0, Max HS Gear - 1] - Valid Selector range: [0, 1] This effectively forms a 2-dimensional array. For HS-Gear n, its TX Equalization settings are stored/retrieved at Index (n - 1). Selector is configurable via a module parameter so that platforms can choose the Selector policy that matches their use. Implementation Overview ======================= 1. Introduce a generic helper for 64-bit query attributes: ufshcd_query_attr_qword(). 2. Add TX EQ settings persistence flow: - Read stored settings from qTxEQGnSettings & wTxEQGnSettingsExt. - Decode and populate per-gear TX EQ parameters. - Use Bit[15] in wTxEQGnSettingsExt as validity indication. - Store trained settings back to these attributes for future reuse. 3. Integrate with existing lifecycle: - Retrieve settings during device parameter initialization. - Store settings during shutdown. New Module Parameters ===================== Three module parameters are added for TX EQ settings persistence control: - txeq_setting_sel (default: 0, range: 0..1) Selects which selector value is used when reading/writing qTxEQGnSettings and wTxEQGnSettingsExt. - retrieve_txeq_setting (default: true) Enables/disables retrieving stored TX EQ settings from device attributes during initialization. - store_txeq_setting (default: true) Enables/disables storing last trained TX EQ settings into device attributes during shutdown. Testing ======= Tested on a UFS v5.0 platform: - TX Equalization setting store path, settings were correctly encoded and stored. - TX Equalization setting retrieval path, settings were correctly extracted and reused. - Full TX EQTR procedure was skipped for a given HS Gear when valid TX EQ settings were provided in qTxEQGnSettings & wTxEQGnSettingsExt for the given HS-Gear. Link: https://patch.msgid.link/20260424151420.111675-1-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-05scsi: ufs: core: Add support to retrieve and store TX Equalization settingsCan Guo
Add support for UFS v5.0 JEDEC attributes qTxEQGnSettings and wTxEQGnSettingsExt to enable persistent storage and retrieval of optimal TX Equalization settings. This provides a fast-path for TX Equalization by reusing previously stored optimal settings, avoiding TX Equalization Training (EQTR) procedures during subsequent Power Mode changes. When no valid TX Equalization settings are found, fall back to full TX EQTR procedures and optionally save the results for future use. The validity of one set of TX Equalization settings is indicated by Bit[15] in wTxEQGnSettingsExt. Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260424151420.111675-3-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-05scsi: ufs: core: Introduce function ufshcd_query_attr_qword()Can Guo
Introduce a new generic function ufshcd_query_attr_qword() to handle quad-word (64-bit) UFS attribute operations. This consolidates the handling of 64-bit attributes which was previously scattered across multiple specialized functions. Reviewed-by: Peter Wang <peter.wang@mediatek.com> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260424151420.111675-2-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-05media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicelySakari Ailus
If a sub-device does not set enable_streams() and disable_streams() pad ops while it sets the s_stream() video op to v4l2_subdev_s_stream_helper(), enabling or disabling streaming either way on the sub-device will result calling v4l2_subdev_s_stream_helper() and v4l2_subdev_{enable,disable}_streams() recursively, exhausting the stack. Return -ENOIOCTLCMD in this case to handle the situation gracefully. Fixes: b62949ddaa52 ("media: subdev: Support single-stream case in v4l2_subdev_enable/disable_streams()") Cc: stable@vger.kernel.org Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
2026-05-05drm/i915/display: enable ccs modifiers on dg2Juha-Pekka Heikkila
Since Xe driver aux ccs enablement dg2 ccs modifiers have been disabled on i915 driver. Here allow dg2 to use ccs again for framebuffers. Fixes: 6a99e91a6ca8 ("drm/i915/display: Detect AuxCCS support via display parent interface") Signed-off-by: Juha-Pekka Heikkila <juhapekka.heikkila@gmail.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Signed-off-by: Mika Kahola <mika.kahola@intel.com> Link: https://patch.msgid.link/20260427165715.864721-1-juhapekka.heikkila@gmail.com (cherry picked from commit aee13ba1448213975f36942ba5d1ce693eb5c002) Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-05-05cpufreq: qcom-cpufreq-hw: Fix possible double freeGuangshuo Li
qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an array of per-domain data. qcom_cpufreq_hw_cpu_init() stores a pointer to one element of this array in policy->driver_data. qcom_cpufreq_hw_cpu_exit() currently calls kfree() on policy->driver_data. This is not valid because the memory is devm-managed. For the first domain, this can free the devm-managed allocation while the devres entry is still active, leading to a possible double free when the platform device is later detached. For other domains, the pointer may refer to an element inside the array rather than the allocation base. Remove the kfree(data) call and let devres release qcom_cpufreq.data. This issue was found by a static analysis tool I am developing. Fixes: 054a3ef683a1 ("cpufreq: qcom-hw: Allocate qcom_cpufreq_data during probe") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-05-05cpufreq: apple-soc: Use FIELD_MODIFY()Hans Zhang
Use FIELD_MODIFY() to remove open-coded bit manipulation. No functional change intended. Signed-off-by: Hans Zhang <18255117159@163.com> Reviewed-by: Joshua Peisach <jpeisach@ubuntu.com> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-05-05cpufreq/amd-pstate: Use FIELD_MODIFY()Hans Zhang
Use FIELD_MODIFY() to remove open-coded bit manipulation. No functional change intended. Signed-off-by: Hans Zhang <18255117159@163.com> Reviewed-by: K Prateek Nayak <kprateek.nayak@amd.com> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-05-05drm/i915/hdcp: Drop mgr->base.lock acquisition in intel_conn_to_vcpi()Suraj Kandpal
Now that intel_conn_to_vcpi() reads the MST topology state via drm_atomic_get_new_mst_topology_state(), the topology state belongs to this atomic commit and is already serialized through the atomic state's private object machinery. There is no need to additionally take mgr->base.lock here. Taking it from the HDCP enable path in commit_tail with state->base.acquire_ctx is also unsafe: by this point the acquire_ctx is no longer in a state where new modeset locks may be acquired through it, which produces a modeset-lock splat on MST + HDCP. Drop the drm_modeset_lock() call. Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Tested-by: Santhosh Reddy Guddati <santhosh.reddy.guddati@intel.com> Reviewed-by: Santhosh Reddy Guddati <santhosh.reddy.guddati@intel.com> Link: https://patch.msgid.link/20260504101117.3619984-3-suraj.kandpal@intel.com
2026-05-05drm/i915/hdcp: Use new MST topology state in intel_conn_to_vcpi()Suraj Kandpal
intel_conn_to_vcpi() runs from the HDCP enable path in commit_tail and looks up the VCPI via mgr->base.state. When an ALLOCATE_PAYLOAD is being driven on the mgr just before HDCP enable, that payload list is being mutated in place, so the lookup can miss the port and trip drm_WARN_ON(!payload), causing HDCP to be programmed with VCPI 0. Use drm_atomic_get_new_mst_topology_state() to read the topology state attached to this atomic commit (stable, decided in atomic_check), and bail out cleanly when no topology state or payload is present for this port instead of WARNing. Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Tested-by: Santhosh Reddy Guddati <santhosh.reddy.guddati@intel.com> Reviewed-by: Santhosh Reddy Guddati <santhosh.reddy.guddati@intel.com> Link: https://patch.msgid.link/20260504101117.3619984-2-suraj.kandpal@intel.com
2026-05-05cpufreq: qcom: Unify user-visible "Qualcomm" nameKrzysztof Kozlowski
Various names for Qualcomm as a company are used in user-visible config options. Switch to unified "Qualcomm" so it will be easier for users to identify the options when for example running menuconfig. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-05-04net: airoha: Introduce airoha_fe_get()/airoha_qdma_get() register read helpersLorenzo Bianconi
Add airoha_fe_get() and airoha_qdma_get() as utility routines for reading a masked field from a specified register. This is a non-functional refactor, no logical changes are introduced to the existing codebase. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260501-airoha_fe_get-airoha_qdma_get-v3-1-126c6f647ccb@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-04net: dsa: mt7530: fix .get_stats64 sleeping in atomic contextDaniel Golle
The .get_stats64 callback runs in atomic context, but on MDIO-connected switches every register read acquires the MDIO bus mutex, which can sleep: [ 12.645973] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:609 [ 12.654442] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 759, name: grep [ 12.663377] preempt_count: 0, expected: 0 [ 12.667410] RCU nest depth: 1, expected: 0 [ 12.671511] INFO: lockdep is turned off. [ 12.675441] CPU: 0 UID: 0 PID: 759 Comm: grep Tainted: G S W 7.0.0+ #0 PREEMPT [ 12.675453] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN [ 12.675456] Hardware name: Bananapi BPI-R64 (DT) [ 12.675459] Call trace: [ 12.675462] show_stack+0x14/0x1c (C) [ 12.675477] dump_stack_lvl+0x68/0x8c [ 12.675487] dump_stack+0x14/0x1c [ 12.675495] __might_resched+0x14c/0x220 [ 12.675504] __might_sleep+0x44/0x80 [ 12.675511] __mutex_lock+0x50/0xb10 [ 12.675523] mutex_lock_nested+0x20/0x30 [ 12.675532] mt7530_get_stats64+0x40/0x2ac [ 12.675542] dsa_user_get_stats64+0x2c/0x40 [ 12.675553] dev_get_stats+0x44/0x1e0 [ 12.675564] dev_seq_printf_stats+0x24/0xe0 [ 12.675575] dev_seq_show+0x14/0x3c [ 12.675583] seq_read_iter+0x37c/0x480 [ 12.675595] seq_read+0xd0/0xec [ 12.675605] proc_reg_read+0x94/0xe4 [ 12.675615] vfs_read+0x98/0x29c [ 12.675625] ksys_read+0x54/0xdc [ 12.675633] __arm64_sys_read+0x18/0x20 [ 12.675642] invoke_syscall.constprop.0+0x54/0xec [ 12.675653] do_el0_svc+0x3c/0xb4 [ 12.675662] el0_svc+0x38/0x200 [ 12.675670] el0t_64_sync_handler+0x98/0xdc [ 12.675679] el0t_64_sync+0x158/0x15c For MDIO-connected switches, poll MIB counters asynchronously using a delayed workqueue every second and let .get_stats64 return the cached values under a spinlock. A mod_delayed_work() call on each read triggers an immediate refresh so counters stay responsive when queried more frequently. MMIO-connected switches (MT7988, EN7581, AN7583) are not affected because their regmap does not sleep, so they continue to read MIB counters directly in .get_stats64. Fixes: 88c810f35ed5 ("net: dsa: mt7530: implement .get_stats64") Signed-off-by: Daniel Golle <daniel@makrotopia.org> Acked-by: Chester A. Unal <chester.a.unal@arinc9.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/6940b913da2c29156f0feff74b678d3c526ee84c.1777719253.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-04net: phy: realtek: replace magic number with register bit macrosAleksander Jan Bajkowski
Replace magic number with register bit macros. The description of the RTL8211B interrupt register is obtained from publicly available datasheet (RTL8211B(L) Rev. 1.5 Datasheet) Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl> Reviewed-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/20260502092857.156831-1-olek2@wp.pl Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-04net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCESErni Sri Satya Vennela
In a CVM environment, hardware responses cannot be trusted. The GDMA_QUERY_MAX_RESOURCES command returns resource limits used to determine the maximum number of queues. In mana_gd_query_max_resources(), gc->max_num_queues is initialized from num_online_cpus() and successively clamped by the hardware-reported max_eq, max_cq, max_sq, max_rq, and num_msix_usable values. If any of these hardware values is zero, gc->max_num_queues becomes zero and the function returns success. This leads to a confusing failure later when alloc_etherdev_mq() is called with zero queues, returning NULL and producing a misleading -ENOMEM error. Add an explicit zero check for gc->max_num_queues after all clamping steps and return -ENOSPC for a clear early failure, consistent with the existing gc->num_msix_usable <= 1 guard. Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com> Reviewed-by: Shradha Gupta <shradhagupta@linux.microsoft.com> Link: https://patch.msgid.link/20260430083627.1873757-1-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-04net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIGErni Sri Satya Vennela
As a part of MANA hardening for CVM, validate that max_num_sq and max_num_rq returned by MANA_QUERY_VPORT_CONFIG are not zero. These values flow into apc->num_queues, which is used as an allocation count and loop bound. A zero value would result in zero-size allocations and incorrect driver behavior. Return -EPROTO if either value is zero. Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com> Link: https://patch.msgid.link/20260430085638.1875400-1-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-04net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacksMarkus Baier
Commit e0bffe3e6894 ("net: asix: ax88772: migrate to phylink") replaced the asix_adjust_link() PHY callback with phylink's mac_link_up() and mac_link_down() handlers, but did not carry over the usbnet_link_change() notification that commit 805206e66fab ("net: asix: fix "can't send until first packet is send" issue") had added. As a result, the original symptom returns: when the link comes up, usbnet is never notified, so the RX URB submission stays dormant until some other event (e.g. a transmitted packet triggering the status endpoint interrupt) wakes it up. This is reproducible with the Apple A1277 USB Ethernet Adapter (05ac:1402, AX88772A based) on a Banana Pro using a static IPv4 configuration. After bringing the interface up, no incoming packets are received until the first outgoing frame triggers usbnet's RX path. Restore the link change notification, gated on a carrier transition so the call remains idempotent if the status endpoint also reports the change later. Fixes: e0bffe3e6894 ("net: asix: ax88772: migrate to phylink") Signed-off-by: Markus Baier <Markus.Baier@soslab.tu-darmstadt.de> Tested-by: Oleksij Rempel <o.rempel@pengutronix.de> Link: https://patch.msgid.link/20260501163941.107668-1-Markus.Baier@soslab.tu-darmstadt.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-11 21:09:11 +0000