summaryrefslogtreecommitdiffstats
path: root/drivers
AgeCommit message (Collapse)AuthorLines
2026-04-13Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on errorJonathan Rissanen-0/+3
When hci_register_dev() fails in hci_uart_register_dev() HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu) and setting hu->hdev to NULL. This means incoming UART data will reach the protocol-specific recv handler in hci_uart_tty_receive() after resources are freed. Clear HCI_UART_PROTO_INIT with a write lock before calling hu->proto->close() and setting hu->hdev to NULL. The write lock ensures all active readers have completed and no new reader can enter the protocol recv path before resources are freed. This allows the protocol-specific recv functions to remove the "HCI_UART_REGISTERED" guard without risking a null pointer dereference if hci_register_dev() fails. Fixes: 5df5dafc171b ("Bluetooth: hci_uart: Fix another race during initialization") Signed-off-by: Jonathan Rissanen <jonathan.rissanen@axis.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-13Bluetooth: hci_qca: disable power control for WCN7850 when bt_en is not definedShuai Zhang-1/+2
On platforms using an M.2 slot with both UART and USB support, bt_en is pulled high by hardware. In this case, software-based power control should be disabled. The current platforms are Lemans-EVK and Monaco-EVK. Add QCA_WCN7850 to the existing condition so that power_ctrl_enabled is cleared when bt_en is not software-controlled (or absent), aligning its behavior with WCN6750 and WCN6855 Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-13bluetooth: btusb: Fix whitespace in btusb.cLukas Kraft-1/+2
Replace single space with tab and insert blank line after declaration, according to checkpatch Signed-off-by: Lukas Kraft <rebootrequired42@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-13net: team: Add new tx_enabled team port optionMarc Harvey-0/+55
This option allows independent control over tx enablement without affecting rx enablement. Like the rx_enabled option, this also implicitly affects the enabled option. If this option is not used, then the enabled option will continue to behave as it did before. Tested in a follow-up patch with a new selftest. Reviewed-by: Jiri Pirko <jiri@nvidia.com> Signed-off-by: Marc Harvey <marcharvey@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-9-f47e7589685d@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-13net: team: Add new rx_enabled team port optionMarc Harvey-0/+49
Allow independent control over rx enablement via the rx_enabled option without affecting tx enablement. This affects the normal enabled option since a port is only considered enabled if both tx and rx are enabled. If this option is not used, then the enabled option will continue to behave exactly as it did before. Tested in a follow-up patch with a new selftest. Reviewed-by: Jiri Pirko <jiri@nvidia.com> Signed-off-by: Marc Harvey <marcharvey@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-8-f47e7589685d@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-13net: team: Track rx enablement separately from tx enablementMarc Harvey-25/+81
Separate the rx and tx enablement/disablement into different functions so that it is easier to interact with them independently later. Although this patch changes receive and transmit paths, the actual behavior of the teaming driver should remain unchanged, since there is no option introduced yet to change rx or tx enablement independently. Those options will be added in follow-up patches. Reviewed-by: Jiri Pirko <jiri@nvidia.com> Signed-off-by: Marc Harvey <marcharvey@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-7-f47e7589685d@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-13net: team: Rename enablement functions and struct members to txMarc Harvey-25/+27
Add no functional changes, but rename enablement functions, variables etc. that are used in teaming driver transmit decisions. Since rx and tx enablement are still coupled, some of the variables renamed in this patch are still used for the rx path, but that will change in a follow-up patch. Reviewed-by: Jiri Pirko <jiri@nvidia.com> Signed-off-by: Marc Harvey <marcharvey@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-6-f47e7589685d@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-13net: team: Rename port_disabled team mode op to port_tx_disabledMarc Harvey-4/+4
This team mode op is only used by the load balance mode, and it only uses it in the tx path. Reviewed-by: Jiri Pirko <jiri@nvidia.com> Signed-off-by: Marc Harvey <marcharvey@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-3-f47e7589685d@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-13net: team: Remove unused team_mode_op, port_enabledMarc Harvey-2/+0
This team_mode_op wasn't used by any of the team modes, so remove it. Reviewed-by: Jiri Pirko <jiri@nvidia.com> Signed-off-by: Marc Harvey <marcharvey@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-2-f47e7589685d@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-13net: team: Annotate reads and writes for mixed lock accessed valuesMarc Harvey-6/+7
The team_port's "index" and the team's "en_port_count" are read in the hot transmit path, but are only written to when holding the rtnl lock. Use READ_ONCE() for all lockless reads of these values, and use WRITE_ONCE() for all writes. Reviewed-by: Jiri Pirko <jiri@nvidia.com> Signed-off-by: Marc Harvey <marcharvey@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-1-f47e7589685d@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-13ipmi:ssif: Remove unnecessary indentionCorey Minyard-16/+12
A section was in {} that didn't need to be, move the variable definition to the top and set th eindentino properly. Signed-off-by: Corey Minyard <corey@minyard.net>
2026-04-13platform/x86: hp-wmi: add Omen 14-fb0xxx (board 8C58) supportShaun Varghese-0/+1
Board 8C58 (HP Omen Transcend Gaming Laptop 14-fb0xxx) appears to use the same thermal profile handling as other supported Omen systems, including board 8E41. Add it to omen_thermal_profile_boards so hp-wmi can expose the firmware thermal profiles through the platform_profile interface. Tested on Omen 14-fb0xxx: the profile handler exposes cool, balanced, and performance modes, and selecting performance increases sustained CPU package power under load. Signed-off-by: Shaun Varghese <shaunvarghese43@gmail.com> Link: https://patch.msgid.link/20260410174651.1424000-1-shaunvarghese43@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-13platform/wmi: Replace .no_notify_data with .min_event_sizeArmin Wolf-11/+19
WMI drivers using the buffer-based WMI API are expected to reject undersized event payloads. Extend the WMI driver core to allow such drivers to specify their minimum supported event payload size. Also remove the now redundant .no_notify_data field. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260406203237.2970-7-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-13platform/wmi: Extend wmidev_query_block() to reject undersized dataArmin Wolf-11/+8
WMI drivers using the buffer-based WMI API are expected to reject undersized query results. Extend wmidev_query_block() to enable the WMI driver core to perform this size check internally. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260406203237.2970-6-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-13platform/wmi: Extend wmidev_invoke_method() to reject undersized dataArmin Wolf-21/+13
WMI drivers using the buffer-based WMI API are expected to reject undersized method return values. Extend wmidev_invoke_method() to enable the WMI driver core to perform this size check internally. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260406203237.2970-5-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-13platform/wmi: Prepare to reject undersized unmarshalling resultsArmin Wolf-7/+32
Driver using the buffer-based WMI API usually reject buffers resulting from WMI method calls or block queries if they contain not enough data. Prepare the WMI core for assisting in this by automatically rejecting undersized unmarshalling results. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260406203237.2970-4-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-13platform/wmi: Convert drivers to use wmidev_invoke_procedure()Armin Wolf-9/+10
Convert users of wmidev_invoke_method() to wmidev_invoke_procedure() where applicable to prepare for future changes. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260406203237.2970-3-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-13platform/wmi: Add wmidev_invoke_procedure()Armin Wolf-0/+44
Some WMI methods return no values, so the whole postprocessing of the result data is not needed for them. Add a special function for calling such WMI methods to prepare for future changes of the main wmidev_invoke_method() function. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260406203237.2970-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-13platform/x86: int3472: Add support for GPIO type 0x02 (IR flood LED)Marco Nenciarini-12/+20
Add support for GPIO type 0x02, which controls an IR flood LED used for face authentication on some laptops (e.g. Dell Pro Max 16 Premium). Without this patch, the kernel logs "GPIO type 0x02 unknown; the sensor may not work" and IR sensors paired with a flood LED cannot function. The flood LED is registered through the LED subsystem like the existing privacy LED, including a lookup entry to allow future consumer drivers to find and control it via led_get(). To support multiple LEDs per INT3472 device, convert the single led struct member to an array with a counter. Signed-off-by: Marco Nenciarini <mnencia@kcore.it> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Link: https://patch.msgid.link/20260401203638.1601661-5-mnencia@kcore.it Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-13drm/bridge: stm_lvds: Do not fail atomic_check on disabled connectorMarek Vasut-3/+3
If the connector is disabled, the new connector state has .crtc field set to NULL and there is nothing more to validate after that point. The .crtc field being NULL is not an error. Test for .crtc being NULL, and if it is NULL, exit early with return 0. This fixes a failure in suspend/resume path, where the connector is already disabled, but .atomic_check is called, fails, returns -EINVAL and blocks the suspend entry. Fixes: aca1cbc1c986 ("drm/stm: lvds: add new STM32 LVDS Display Interface Transmitter driver") Signed-off-by: Marek Vasut <marex@nabladev.com> Acked-by: Raphaël Gallais-Pou <raphael.gallais-pou@foss.st.com> Link: https://patch.msgid.link/20260409024928.344010-1-marex@nabladev.com Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
2026-04-13power: reset: Add QEMU virt-ctrl driverKuan-Wei Chiu-0/+133
Add a new driver for the 'virt-ctrl' device found on QEMU virt machines (e.g. m68k). This device provides a simple interface for system reset and power off [1]. This driver utilizes the modern system-off API to register callbacks for both system restart and power off. It also registers a reboot notifier to catch SYS_HALT events, ensuring that LINUX_REBOOT_CMD_HALT is properly handled. It is designed to be generic and can be reused by other architectures utilizing this QEMU device. Link: https://gitlab.com/qemu-project/qemu/-/blob/v10.2.0/hw/misc/virt_ctrl.c [1] Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com> Link: https://patch.msgid.link/20260412211952.3564033-2-visitorckw@gmail.com Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2026-04-13Merge tag 'kvmarm-7.1' of ↵Paolo Bonzini-1/+19
git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 7.1 * New features: - Add support for tracing in the standalone EL2 hypervisor code, which should help both debugging and performance analysis. This comes with a full infrastructure for 'remote' trace buffers that can be exposed by non-kernel entities such as firmware. - Add support for GICv5 Per Processor Interrupts (PPIs), as the starting point for supporting the new GIC architecture in KVM. - Finally add support for pKVM protected guests, with anonymous memory being used as a backing store. About time! * Improvements and bug fixes: - Rework the dreaded user_mem_abort() function to make it more maintainable, reducing the amount of state being exposed to the various helpers and rendering a substantial amount of state immutable. - Expand the Stage-2 page table dumper to support NV shadow page tables on a per-VM basis. - Tidy up the pKVM PSCI proxy code to be slightly less hard to follow. - Fix both SPE and TRBE in non-VHE configurations so that they do not generate spurious, out of context table walks that ultimately lead to very bad HW lockups. - A small set of patches fixing the Stage-2 MMU freeing in error cases. - Tighten-up accepted SMC immediate value to be only #0 for host SMCCC calls. - The usual cleanups and other selftest churn.
2026-04-13Merge remote-tracking branches 'ras/edac-misc' and 'ras/edac-drivers' into ↵Borislav Petkov (AMD)-102/+126
edac-updates * ras/edac-misc: EDAC/mc: Use kzalloc_flex() EDAC/ie31200: Make rpl_s_cfg static EDAC/mpc85xx: Constify device sysfs attributes EDAC/device: Allow addition of const sysfs attributes EDAC/pci_sysfs: Constify instance sysfs attributes EDAC/device: Constify info sysfs attributes EDAC/device: Drop unnecessary and dangerous casts of attributes EDAC/device: Drop unused macro to_edacdev_attr() EDAC/altera: Drop unused field eccmgr_sysfs_attr * ras/edac-drivers: EDAC/i10nm: Fix spelling mistake "readd" -> "read" EDAC/versalnet: Fix device_node leak in mc_probe() EDAC/versalnet: Fix memory leak in remove and probe error paths EDAC/amd64: Add support for family 19h, models 40h-4fh EDAC/i10nm: Add driver decoder for Granite Rapids server EDAC/sb: Use kzalloc_flex() EDAC/i7core: Use kzalloc_flex() EDAC/versalnet: Refactor memory controller initialization and cleanup Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
2026-04-13HID: core: clamp report_size in s32ton() to avoid undefined shiftGreg Kroah-Hartman-0/+3
s32ton() shifts by n-1 where n is the field's report_size, a value that comes directly from a HID device. The HID parser bounds report_size only to <= 256, so a broken HID device can supply a report descriptor with a wide field that triggers shift exponents up to 256 on a 32-bit type when an output report is built via hid_output_field() or hid_set_field(). Commit ec61b41918587 ("HID: core: fix shift-out-of-bounds in hid_report_raw_event") added the same n > 32 clamp to the function snto32(), but s32ton() was never given the same fix as I guess syzbot hadn't figured out how to fuzz a device the same way. Fix this up by just clamping the max value of n, just like snto32() does. Cc: stable <stable@kernel.org> Cc: Jiri Kosina <jikos@kernel.org> Cc: Benjamin Tissoires <bentiss@kernel.org> Cc: linux-input@vger.kernel.org Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-04-13drm/i915: Walk crtcs in pipe orderVille Syrjälä-52/+64
Currently our crtcs are registered in pipe order, and thus all the for_intel_crtc*() iterators walk the crtcs in pipe order. There are a bunch of places that more or less depend on that. Eg. during plane updates and such we want joined pipes to be processed back-to-back to give a better chance of an atomic update across the whole set. When we start to register crtcs in a different order we don't want to change the order in which the pipes get handled. Decouple the for_each_intel_crtc*() iterators from the crtc registration order by using a separate list which will be sorted by the pipe rather than the crtc index. We could probably use a simple array or something, but that would require some kind of extra iterator variable for the macros, and thus would require a lot more changes. Using a linked list keeps the fallout minimal. We can look at using a more optimal data structure later. I also added this extra junk to the atomic state iterators: "(__i) = drm_crtc_index(&(crtc)->base), (void)(__i)" even though the macro itself no longer needs the "__i" iterator. This in case the "__i" is used by the caller, and to avoid compiler warnings if it's completely unused now. v2: Flip the pipe comparison (Jani) Reviewed-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260408155744.13326-3-ville.syrjala@linux.intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-04-13drm/i915/joiner: Make joiner "nomodeset" state copy independent of pipe orderVille Syrjälä-15/+5
Currently the joiner primary->secondary hw state copy still happens from the main compute_config loop alongside the primary uapi->hw state copy. The primary uapi->hw state copy must therefore happen first, or else we'll end up copying stale junk into the secondary. We have a WARN in intel_atomic_check_joiner() to make sure the CRTCs will be walked in the correct order. The plan is to reoder the CRTCs, which would mess up the order, unless we also adjust the iterators to keep the pipe order. The actual plan is to do both, so technically we should be able to just remove the WARN and call it a day. But relying on the iteration order like this is fragile and confusing, so let's move the "nomodeset" joiner state copy into the later loop where the "modeset" state copy is also done. The first loop having completely finished, we are guaranteed to have up to date hw state on the primary when we do the copy to the secondary. Cc: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260408155744.13326-2-ville.syrjala@linux.intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-04-12hte: tegra194: Add Tegra264 GTE supportSuneel Garapati-5/+128
Add AON-GTE mapping and LIC GTE instance support for the Tegra264. Move TSC clock parameters from macros to members of SoC data as values differ for Tegra264 chip. Signed-off-by: Suneel Garapati <suneelg@nvidia.com> Reviewed-by: Dipen Patel <dipenp@nvidia.com> Signed-off-by: Dipen Patel <dipenp@nvidia.com>
2026-04-12mailbox: mailbox-test: free channels on probe errorWolfram Sang-3/+12
On probe error, free the previously obtained channels. This not only prevents a leak, but also UAF scenarios because the client structure will be removed nonetheless because it was allocated with devm. Link: https://sashiko.dev/#/patchset/20260327151217.5327-2-wsa%2Brenesas%40sang-engineering.com Fixes: 8ea4484d0c2b ("mailbox: Add generic mechanism for testing Mailbox Controllers") Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-04-12mailbox: prefix new constants with MBOX_Wolfram Sang-16/+16
Commit 89e5d7d61600 ("mailbox: remove superfluous internal header") moved some constants to a public header but forgot to add a mailbox specific prefix. Add this now to prevent future collisions on a too generic naming. Link: https://sashiko.dev/#/patchset/20260327151112.5202-2-wsa%2Brenesas%40sang-engineering.com Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2026-04-12net: ipa: add IPA v5.2 configuration dataLuca Weiss-1/+464
Add the configuration data required for IPA v5.2, which is used in the Qualcomm Milos SoC. Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Luca Weiss <luca.weiss@fairphone.com> Link: https://patch.msgid.link/20260410-ipa-v5-2-v2-2-778422a05060@fairphone.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registersDaniel Golle-1/+52
The PPE enforces output frame size limits via per-tag-layer VLAN_MTU registers that the driver never initializes. The hardware defaults do not account for PPPoE overhead, causing the PPE to punt encapsulated frames back to the CPU instead of forwarding them. Initialize the registers at PPE start and on MTU changes using the maximum GMAC MTU. This is a conservative approximation -- the actual per-PPE requirement depends on egress path, but using the global maximum ensures the limits are never too small. Fixes: ba37b7caf1ed2 ("net: ethernet: mtk_eth_soc: add support for initializing the PPE") Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/ec995ab8ce8be423267a1cc093147a74d2eb9d82.1775789829.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12pppox: remove sk_pppox() helperQingfang Deng-8/+8
The sk member can be directly accessed from struct pppox_sock without relying on type casting. Remove the sk_pppox() helper and update all call sites to use po->sk directly. Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev> Link: https://patch.msgid.link/20260410054954.114031-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-13rtc: abx80x: Disable alarm feature if no interrupt attachedAnthony Pighin (Nokia)-0/+2
Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm") exposed an issue where the rtc-abx80x driver does not clear the alarm feature bit, but instead relies on the set_alarm operation to return invalid. For example, when a RTC_UIE_ON ioctl is handled, it should abort at the feature validation. Instead, it proceeds to the rtc_timer_enqueue(), which used to return an error from the set_alarm call. However, following the race condition handling, which likely should not be discarding predecing errors, a success condition is returned to the ioctl() caller. This results in (for example): hwclock: select() to /dev/rtc0 to wait for clock tick timed out Notwithstanding the validity of the race condition handling, if an interrupt wasn't specified, or could not be attached, the driver should clear the alarm feature bit. Fixes: 718a820a303c ("rtc: abx80x: add alarm support") Signed-off-by: Anthony Pighin <anthony.pighin@nokia.com> Link: https://patch.msgid.link/BN0PR08MB69510928028C933749F4139383D1A@BN0PR08MB6951.namprd08.prod.outlook.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-04-12net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic()Gal Pressman-8/+4
The do-while poll loop uses jiffies for its timeout: expires = jiffies + msecs_to_jiffies(10); jiffies is sampled at an arbitrary point within the current tick, so the first partial tick contributes anywhere from a full tick down to nearly zero real time. For small msecs_to_jiffies() results this is significant, the effective poll window can be much shorter than the requested 10ms, and in the worst case the loop exits after a single iteration (e.g., when HZ=100), well before the device has delivered the CQE. Replace the loop with read_poll_timeout_atomic(), which counts elapsed time via udelay() accounting rather than jiffies, guaranteeing the full poll window regardless of HZ. Additionally, read_poll_timeout_atomic() executes the poll operation one more time after the timeout has expired, giving the CQE a final chance to be detected. The old do-while loop could exit without a final poll if the timeout expired during the udelay() between iterations. Fixes: 76e463f6508b ("net/mlx5e: Overcome slow response for first IPsec ASO WQE") Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Jianbo Liu <jianbol@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260409202852.158059-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net/mlx5e: Fix features not applied during netdev registrationGal Pressman-0/+8
mlx5e_fix_features() returns early when the netdevice is not present. This is correct during profile transitions where priv is cleared, but it also incorrectly blocks feature fixups during register_netdev(), when the device is also not yet present. It is not trivial to distinguish between both cases as we cannot use priv to carry state, and in both cases reg_state == NETREG_REGISTERED. Force a netdev features update after register_netdev() completes, where the device is present and fix_features() can actually work. This is not a pretty solution, as it results in an additional features update call (register_netdevice() already calls __netdev_update_features() internally), but it is the simplest, cleanest, and most robust way I found to fix this issue after multiple attempts. This fixes an issue on systems where CQE compression is enabled by default, RXHASH remains enabled after registration despite the two features being mutually exclusive. Fixes: ab4b01bfdaa6 ("net/mlx5e: Verify dev is present for fix features ndo") Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260409202852.158059-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12Merge branch 'mlx5-next' of ↵Jakub Kicinski-6/+5
git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Tariq Toukan says: ==================== mlx5-next updates 2026-04-09 * 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: Add icm_mng_function_id_mode cap bit net/mlx5: Rename MLX5_PF page counter type to MLX5_SELF net/mlx5: Add vhca_id_type bit to alias context mlx5: Remove redundant iseg base ==================== Link: https://patch.msgid.link/20260409110431.154894-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12Merge branch 'net-reduce-sk_filter-and-friends-bloat'Jakub Kicinski-3/+5
Eric Dumazet says: ==================== net: reduce sk_filter() (and friends) bloat Some functions return an error by value, and a drop_reason by an output parameter. This extra parameter can force stack canaries. A drop_reason is enough and more efficient. This series reduces bloat by 678 bytes on x86_64: $ scripts/bloat-o-meter -t vmlinux.old vmlinux.final add/remove: 0/0 grow/shrink: 3/18 up/down: 79/-757 (-678) Function old new delta vsock_queue_rcv_skb 50 79 +29 ipmr_cache_report 1290 1315 +25 ip6mr_cache_report 1322 1347 +25 tcp_v6_rcv 3169 3167 -2 packet_rcv_spkt 329 327 -2 unix_dgram_sendmsg 1731 1726 -5 netlink_unicast 957 945 -12 netlink_dump 1372 1359 -13 sk_filter_trim_cap 889 858 -31 netlink_broadcast_filtered 1633 1595 -38 tcp_v4_rcv 3152 3111 -41 raw_rcv_skb 122 80 -42 ping_queue_rcv_skb 109 61 -48 ping_rcv 215 162 -53 rawv6_rcv_skb 278 224 -54 __sk_receive_skb 690 632 -58 raw_rcv 591 527 -64 udpv6_queue_rcv_one_skb 935 869 -66 udp_queue_rcv_one_skb 919 853 -66 tun_net_xmit 1146 1074 -72 sock_queue_rcv_skb_reason 166 76 -90 Total: Before=29722890, After=29722212, chg -0.00% Future conversions from sock_queue_rcv_skb() to sock_queue_rcv_skb_reason() can be done later. ==================== Link: https://patch.msgid.link/20260409145625.2306224-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: change sk_filter_reason() to return the reason by valueEric Dumazet-3/+5
sk_filter_trim_cap will soon return the reason by value, do the same for sk_filter_reason(). $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 0/2 up/down: 0/-21 (-21) Function old new delta sock_queue_rcv_skb_reason 128 126 -2 tun_net_xmit 1146 1127 -19 Total: Before=29722661, After=29722640, chg -0.00% Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260409145625.2306224-4-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: phy: add a PHY write barrier when disabling interruptsCharles Perry-1/+24
MDIO bus controllers are not required to wait for write transactions to complete before returning as synchronization is often achieved by polling status bits. This can cause issues when disabling interrupts since an interrupt could fire before the interrupt handler is unregistered and there's no status bit to poll. Add a phy_write_barrier() function and use it in phy_disable_interrupts() to fix this issue. The write barrier just reads an MII register and discards the value, which is enough to guarantee that previous writes have completed. Signed-off-by: Charles Perry <charles.perry@microchip.com> Link: https://patch.msgid.link/20260408131821.1145334-4-charles.perry@microchip.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: mdio: add a driver for PIC64-HPSC/HX MDIO controllerCharles Perry-0/+198
This adds an MDIO driver for PIC64-HPSC/HX. The hardware supports C22 and C45 but only C22 is implemented in this commit. This MDIO hardware is based on a Microsemi design supported in Linux by mdio-mscc-miim.c. However, The register interface is completely different with pic64hpsc, hence the need for a separate driver. The documentation recommends an input clock of 156.25MHz and a prescaler of 39, which yields an MDIO clock of 1.95MHz. The hardware supports an interrupt pin or a "TRIGGER" bit that can be polled to signal transaction completion. This commit uses polling. This was tested on Microchip HB1301 evalkit with a VSC8574 and a VSC8541. Signed-off-by: Charles Perry <charles.perry@microchip.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260408131821.1145334-3-charles.perry@microchip.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: phy: fix a return path in get_phy_c45_ids()Charles Perry-2/+2
The return value of phy_c45_probe_present() is stored in "ret", not "phy_reg", fix this. "phy_reg" always has a positive value if we reach this return path (since it would have returned earlier otherwise), which means that the original goal of the patch of not considering -ENODEV fatal wasn't achieved. Fixes: 17b447539408 ("net: phy: c45 scanning: Don't consider -ENODEV fatal") Signed-off-by: Charles Perry <charles.perry@microchip.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20260409133654.3203336-1-charles.perry@microchip.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12rtc: ntxec: fix OF node reference imbalanceJohan Hovold-1/+1
The driver reuses the OF node of the parent multi-function device but fails to take another reference to balance the one dropped by the platform bus code when unbinding the MFD and deregistering the child devices. Fix this by using the intended helper for reusing OF nodes. Fixes: 435af89786c6 ("rtc: New driver for RTC in Netronix embedded controller") Cc: stable@vger.kernel.org # 5.13 Cc: Jonathan Neuschäfer <j.neuschaefer@gmx.net> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260407122717.2676774-1-johan@kernel.org Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-04-12rtc: pic32: allow driver to be compiled with COMPILE_TESTBrian Masney-1/+1
This driver currently only supports builds against a PIC32 target. Now that commit ed65ae9f6c6b ("rtc: pic32: update include to use pic32.h from platform_data") is merged, it's possible to compile this driver on other architectures. To avoid future breakage of this driver in the future, let's update the Kconfig so that it can be built with COMPILE_TEST enabled on all architectures. Signed-off-by: Brian Masney <bmasney@redhat.com> Link: https://patch.msgid.link/20260222-rtc-pic32-v1-1-3f8eb654a34d@redhat.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-04-12rtc: ti-k3: Add support to resume from IO DDR low power modeAkashdeep Kaur-1/+9
Restore the RTC HW context which may be lost when system enters certain low power mode (IO+DDR mode). Check if the RTC registers are locked which would indicate loss of context (reset) and restore the context as needed. Signed-off-by: Akashdeep Kaur <a-kaur@ti.com> Reviewed-by: Vignesh Raghavendra <vigneshr@ti.com> Link: https://patch.msgid.link/20260313111740.1492519-1-a-kaur@ti.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-04-12octeon_ep: Remove unnecessary semicolons in octep_oq_drop_rx()Nobuhiro Iwamatsu-1/+1
Remove unnecessary semicolons in octep_oq_drop_rx(). Signed-off-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.x90@mail.toshiba> Link: https://patch.msgid.link/1775711291-13938-1-git-send-email-nobuhiro.iwamatsu.x90@mail.toshiba Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: ipa: Fix decoding EV_PER_EE for IPA v5.0+Luca Weiss-0/+1
Initially 'reg' and 'val' are assigned from HW_PARAM_2. But since IPA v5.0+ takes EV_PER_EE from HW_PARAM_4 (instead of NUM_EV_PER_EE from HW_PARAM_2), we not only need to re-assign 'reg' but also read the register value of that register into 'val' so that reg_decode() works on the correct value. Fixes: f651334e1ef5 ("net: ipa: add HW_PARAM_4 GSI register") Link: https://sashiko.dev/#/patchset/20260403-milos-ipa-v1-0-01e9e4e03d3e%40fairphone.com?part=2 Signed-off-by: Luca Weiss <luca.weiss@fairphone.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://patch.msgid.link/20260409-ipa-fixes-v1-2-a817c30678ac@fairphone.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: ipa: Fix programming of QTIME_TIMESTAMP_CFGLuca Weiss-3/+3
The 'val' variable gets overwritten multiple times, discarding previous values. Looking at the git log shows these should be combined with |= instead. Fixes: 9265a4f0f0b4 ("net: ipa: define even more IPA register fields") Link: https://sashiko.dev/#/patchset/20260403-milos-ipa-v1-0-01e9e4e03d3e%40fairphone.com?part=4 Signed-off-by: Luca Weiss <luca.weiss@fairphone.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://patch.msgid.link/20260409-ipa-fixes-v1-1-a817c30678ac@fairphone.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12ppp: require CAP_NET_ADMIN in target netns for unattached ioctlsTaegu Ha-0/+3
/dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current->nsproxy->net_ns. As a result, a local unprivileged user can create a new user namespace with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace, and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace. Require CAP_NET_ADMIN in the user namespace that owns the target network namespace before handling unattached PPP administrative ioctls. This preserves normal pppd operation in the network namespace it is actually privileged in, while rejecting the userns-only inherited-netns case. Fixes: 273ec51dd7ce ("net: ppp_generic - introduce net-namespace functionality v2") Signed-off-by: Taegu Ha <hataegu0826@gmail.com> Link: https://patch.msgid.link/20260409071117.4354-1-hataegu0826@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: hamradio: scc: validate bufsize in SIOCSCCSMEM ioctlMashiro Chen-0/+2
The SIOCSCCSMEM ioctl copies a scc_mem_config from user space and assigns its bufsize field directly to scc->stat.bufsize without any range validation: scc->stat.bufsize = memcfg.bufsize; If a privileged user (CAP_SYS_RAWIO) sets bufsize to 0, the receive interrupt handler later calls dev_alloc_skb(0) and immediately writes a KISS type byte via skb_put_u8() into a zero-capacity socket buffer, corrupting the adjacent skb_shared_info region. Reject bufsize values smaller than 16; this is large enough to hold at least one KISS header byte plus useful data. Signed-off-by: Mashiro Chen <mashiro.chen@mailbox.org> Acked-by: Joerg Reuter <jreuter@yaina.de> Link: https://patch.msgid.link/20260409024927.24397-3-mashiro.chen@mailbox.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: hamradio: bpqether: validate frame length in bpq_rcv()Mashiro Chen-0/+3
The BPQ length field is decoded as: len = skb->data[0] + skb->data[1] * 256 - 5; If the sender sets bytes [0..1] to values whose combined value is less than 5, len becomes negative. Passing a negative int to skb_trim() silently converts to a huge unsigned value, causing the function to be a no-op. The frame is then passed up to AX.25 with its original (untrimmed) payload, delivering garbage beyond the declared frame boundary. Additionally, a negative len corrupts the 64-bit rx_bytes counter through implicit sign-extension. Add a bounds check before pulling the length bytes: reject frames where len is negative or exceeds the remaining skb data. Acked-by: Joerg Reuter <jreuter@yaina.de> Signed-off-by: Mashiro Chen <mashiro.chen@mailbox.org> Link: https://patch.msgid.link/20260409024927.24397-2-mashiro.chen@mailbox.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.46.0) at 2026-07-20 22:15:00 +0000