summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-06-03ovpn: ensure sk is still valid during cleanupAntonio Quartulli
Removing a peer while userspace attempts to close its transport socket triggers a race condition resulting in the following crash: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000077: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000003b8-0x00000000000003bf] CPU: 12 UID: 0 PID: 162 Comm: kworker/12:1 Tainted: G O 6.15.0-rc2-00635-g521139ac3840 #272 PREEMPT(full) Tainted: [O]=OOT_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-20240910_120124-localhost 04/01/2014 Workqueue: events ovpn_peer_keepalive_work [ovpn] RIP: 0010:ovpn_socket_release+0x23c/0x500 [ovpn] Code: ea 03 80 3c 02 00 0f 85 71 02 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 64 24 18 49 8d bc 24 be 03 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 30 RSP: 0018:ffffc90000c9fb18 EFLAGS: 00010217 RAX: dffffc0000000000 RBX: ffff8881148d7940 RCX: ffffffff817787bb RDX: 0000000000000077 RSI: 0000000000000008 RDI: 00000000000003be RBP: ffffc90000c9fb30 R08: 0000000000000000 R09: fffffbfff0d3e840 R10: ffffffff869f4207 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888115eb9300 R14: ffffc90000c9fbc8 R15: 000000000000000c FS: 0000000000000000(0000) GS:ffff8882b0151000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f37266b6114 CR3: 00000000054a8000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> unlock_ovpn+0x8b/0xe0 [ovpn] ovpn_peer_keepalive_work+0xe3/0x540 [ovpn] ? ovpn_peers_free+0x780/0x780 [ovpn] ? lock_acquire+0x56/0x70 ? process_one_work+0x888/0x1740 process_one_work+0x933/0x1740 ? pwq_dec_nr_in_flight+0x10b0/0x10b0 ? move_linked_works+0x12d/0x2c0 ? assign_work+0x163/0x270 worker_thread+0x4d6/0xd90 ? preempt_count_sub+0x4c/0x70 ? process_one_work+0x1740/0x1740 kthread+0x36c/0x710 ? trace_preempt_on+0x8c/0x1e0 ? kthread_is_per_cpu+0xc0/0xc0 ? preempt_count_sub+0x4c/0x70 ? _raw_spin_unlock_irq+0x36/0x60 ? calculate_sigpending+0x7b/0xa0 ? kthread_is_per_cpu+0xc0/0xc0 ret_from_fork+0x3a/0x80 ? kthread_is_per_cpu+0xc0/0xc0 ret_from_fork_asm+0x11/0x20 </TASK> Modules linked in: ovpn(O) This happens because the peer deletion operation reaches ovpn_socket_release() while ovpn_sock->sock (struct socket *) and its sk member (struct sock *) are still both valid. Here synchronize_rcu() is invoked, after which ovpn_sock->sock->sk becomes NULL, due to the concurrent socket closing triggered from userspace. After having invoked synchronize_rcu(), ovpn_socket_release() will attempt dereferencing ovpn_sock->sock->sk, triggering the crash reported above. The reason for accessing sk is that we need to retrieve its protocol and continue the cleanup routine accordingly. This crash can be easily produced by running openvpn userspace in client mode with `--keepalive 10 20`, while entirely omitting this option on the server side. After 20 seconds ovpn will assume the peer (server) to be dead, will start removing it and will notify userspace. The latter will receive the notification and close the transport socket, thus triggering the crash. To fix the race condition for good, we need to refactor struct ovpn_socket. Since ovpn is always only interested in the sock->sk member (struct sock *) we can directly hold a reference to it, raher than accessing it via its struct socket container. This means changing "struct socket *ovpn_socket->sock" to "struct sock *ovpn_socket->sk". While acquiring a reference to sk, we can increase its refcounter without affecting the socket close()/destroy() notification (which we rely on when userspace closes a socket we are using). By increasing sk's refcounter we know we can dereference it in ovpn_socket_release() without incurring in any race condition anymore. ovpn_socket_release() will ultimately decrease the reference counter. Cc: Oleksandr Natalenko <oleksandr@natalenko.name> Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Reported-by: Qingfang Deng <dqfext@gmail.com> Closes: https://github.com/OpenVPN/ovpn-net-next/issues/1 Tested-by: Gert Doering <gert@greenie.muc.de> Link: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg31575.html Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2025-06-03ovpn: properly deconfigure UDP-tunnelAntonio Quartulli
When deconfiguring a UDP-tunnel from a socket, we cannot call setup_udp_tunnel_sock() with an empty config, because this helper is expected to be invoked only during setup. Get rid of the call to setup_udp_tunnel_sock() and just revert what it did during socket initialization.. Note that the global udp_encap_needed_key and the GRO state are left untouched: udp_destroy_socket() will eventually take care of them. Cc: Sabrina Dubroca <sd@queasysnail.net> Cc: Oleksandr Natalenko <oleksandr@natalenko.name> Fixes: ab66abbc769b ("ovpn: implement basic RX path (UDP)") Reported-by: Paolo Abeni <pabeni@redhat.com> Closes: https://lore.kernel.org/netdev/1a47ce02-fd42-4761-8697-f3f315011cc6@redhat.com Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2025-06-03net: airoha: Fix smac_id configuration in bridge modeLorenzo Bianconi
Set PPE entry smac_id field to 0xf in airoha_ppe_foe_commit_subflow_entry routine for IPv6 traffic in order to instruct the hw to keep original source mac address for IPv6 hw accelerated traffic in bridge mode. Fixes: cd53f622611f ("net: airoha: Add L2 hw acceleration support") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20250602-airoha-flowtable-ipv6-fix-v2-3-3287f8b55214@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-06-03net: airoha: Fix IPv6 hw acceleration in bridge modeLorenzo Bianconi
ib2 and airoha_foe_mac_info_common have not the same offsets in airoha_foe_bridge and airoha_foe_ipv6 structures. Current codebase does not accelerate IPv6 traffic in bridge mode since ib2 and l2 info are not set properly copying airoha_foe_bridge struct into airoha_foe_ipv6 one in airoha_ppe_foe_commit_subflow_entry routine. Fix IPv6 hw acceleration in bridge mode resolving ib2 and airoha_foe_mac_info_common overwrite in airoha_ppe_foe_commit_subflow_entry() and configuring them with proper values. Fixes: cd53f622611f ("net: airoha: Add L2 hw acceleration support") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20250602-airoha-flowtable-ipv6-fix-v2-2-3287f8b55214@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-06-03net: airoha: Initialize PPE UPDMEM source-mac tableLorenzo Bianconi
UPDMEM source-mac table is a key-value map used to store devices mac addresses according to the port identifier. UPDMEM source mac table is used during IPv6 traffic hw acceleration since PPE entries, for space constraints, do not contain the full source mac address but just the identifier in the UPDMEM source-mac table. Configure UPDMEM source-mac table with device mac addresses and set the source-mac ID field for PPE IPv6 entries in order to select the proper device mac address as source mac for L3 IPv6 hw accelerated traffic. Fixes: 00a7678310fe ("net: airoha: Introduce flowtable offload support") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20250602-airoha-flowtable-ipv6-fix-v2-1-3287f8b55214@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-06-03vmxnet3: correctly report gso type for UDP tunnelsRonak Doshi
Commit 3d010c8031e3 ("udp: do not accept non-tunnel GSO skbs landing in a tunnel") added checks in linux stack to not accept non-tunnel GRO packets landing in a tunnel. This exposed an issue in vmxnet3 which was not correctly reporting GRO packets for tunnel packets. This patch fixes this issue by setting correct GSO type for the tunnel packets. Currently, vmxnet3 does not support reporting inner fields for LRO tunnel packets. The issue is not seen for egress drivers that do not use skb inner fields. The workaround is to enable tnl-segmentation offload on the egress interfaces if the driver supports it. This problem pre-exists this patch fix and can be addressed as a separate future patch. Fixes: dacce2be3312 ("vmxnet3: add geneve and vxlan tunnel offload support") Signed-off-by: Ronak Doshi <ronak.doshi@broadcom.com> Acked-by: Guolin Yang <guolin.yang@broadcom.com> Link: https://patch.msgid.link/20250530152701.70354-1-ronak.doshi@broadcom.com [pabeni@redhat.com: dropped the changelog] Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-06-03net: wwan: t7xx: Fix napi rx poll issueJinjian Song
When driver handles the napi rx polling requests, the netdev might have been released by the dellink logic triggered by the disconnect operation on user plane. However, in the logic of processing skb in polling, an invalid netdev is still being used, which causes a panic. BUG: kernel NULL pointer dereference, address: 00000000000000f1 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:dev_gro_receive+0x3a/0x620 [...] Call Trace: <IRQ> ? __die_body+0x68/0xb0 ? page_fault_oops+0x379/0x3e0 ? exc_page_fault+0x4f/0xa0 ? asm_exc_page_fault+0x22/0x30 ? __pfx_t7xx_ccmni_recv_skb+0x10/0x10 [mtk_t7xx (HASH:1400 7)] ? dev_gro_receive+0x3a/0x620 napi_gro_receive+0xad/0x170 t7xx_ccmni_recv_skb+0x48/0x70 [mtk_t7xx (HASH:1400 7)] t7xx_dpmaif_napi_rx_poll+0x590/0x800 [mtk_t7xx (HASH:1400 7)] net_rx_action+0x103/0x470 irq_exit_rcu+0x13a/0x310 sysvec_apic_timer_interrupt+0x56/0x90 </IRQ> Fixes: 5545b7b9f294 ("net: wwan: t7xx: Add NAPI support") Signed-off-by: Jinjian Song <jinjian.song@fibocom.com> Link: https://patch.msgid.link/20250530031648.5592-1-jinjian.song@fibocom.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-06-03Merge branch 'for-6.16/core' into for-linusJiri Kosina
- power management improvement for multitouch devices (Werner Sembach)
2025-06-03Merge branch 'for-6.16/magicmouse' into for-linusJiri Kosina
- support for Apple Magic Mouse 2 USB-C (Aditya Garg)
2025-06-03Merge branch 'for-6.16/logitech' into for-linusJiri Kosina
2025-06-03Merge branch 'for-6.16/kysona' into for-linusJiri Kosina
- power management improvement (Lode Willems)
2025-06-03Merge branch 'for-6.16/intel-thc' into for-linusJiri Kosina
- fix for ACPI initialization (Wentao Guan)
2025-06-03Merge branch 'for-6.16/hid-gpio-setter-callbacks' into for-linusJiri Kosina
- adapt HID drivers to use new gpio_chip's line setter callbacks (Bartosz Golaszewski)
2025-06-03Merge branch 'for-6.16/corsair' into for-linusJiri Kosina
2025-06-03Merge branch 'for-6.16/core' into for-linusJiri Kosina
- make it possible to set hid_mouse_ignore_list dynamically (the same way we handle other quirks) (Aditya Garg) - fix potential OOB in usbhid_parse() (Terry Junge)
2025-06-03Merge branch 'for-6.16/apple' into for-linusJiri Kosina
- Kconfig dependency fixes (Geert Uytterhoeven) - time scaling fix for appletb_tb_idle_timeout and appletb_tb_dim_timeout parameters (Thorsten Blum)
2025-06-02Merge branch '100GbE' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-05-30 (ice, idpf) For ice: Michal resolves XDP issues related to Tx scheduler configuration with large number of Tx queues. Additional information: https://lore.kernel.org/intel-wired-lan/20250513105529.241745-1-michal.kubiak@intel.com/ For idpf: Brian Vazquez updates netif_subqueue_maybe_stop() condition check to prevent possible races. Emil shuts down virtchannel mailbox during reset to reduce timeout delays as it's unavailable during that time. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: idpf: avoid mailbox timeout delays during reset idpf: fix a race in txq wakeup ice: fix rebuilding the Tx scheduler tree for large queue counts ice: create new Tx scheduler nodes for new queues only ice: fix Tx scheduler error handling in XDP callback ==================== Link: https://patch.msgid.link/20250530211221.2170484-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-02Merge tag 'mm-stable-2025-06-01-14-06' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more MM updates from Andrew Morton: - "zram: support algorithm-specific parameters" from Sergey Senozhatsky adds infrastructure for passing algorithm-specific parameters into zram. A single parameter `winbits' is implemented at this time. - "memcg: nmi-safe kmem charging" from Shakeel Butt makes memcg charging nmi-safe, which is required by BFP, which can operate in NMI context. - "Some random fixes and cleanup to shmem" from Kemeng Shi implements small fixes and cleanups in the shmem code. - "Skip mm selftests instead when kernel features are not present" from Zi Yan fixes some issues in the MM selftest code. - "mm/damon: build-enable essential DAMON components by default" from SeongJae Park reworks DAMON Kconfig to make it easier to enable CONFIG_DAMON. - "sched/numa: add statistics of numa balance task migration" from Libo Chen adds more info into sysfs and procfs files to improve visibility into the NUMA balancer's task migration activity. - "selftests/mm: cow and gup_longterm cleanups" from Mark Brown provides various updates to some of the MM selftests to make them play better with the overall containing framework. * tag 'mm-stable-2025-06-01-14-06' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (43 commits) mm/khugepaged: clean up refcount check using folio_expected_ref_count() selftests/mm: fix test result reporting in gup_longterm selftests/mm: report unique test names for each cow test selftests/mm: add helper for logging test start and results selftests/mm: use standard ksft_finished() in cow and gup_longterm selftests/damon/_damon_sysfs: skip testcases if CONFIG_DAMON_SYSFS is disabled sched/numa: add statistics of numa balance task sched/numa: fix task swap by skipping kernel threads tools/testing: check correct variable in open_procmap() tools/testing/vma: add missing function stub mm/gup: update comment explaining why gup_fast() disables IRQs selftests/mm: two fixes for the pfnmap test mm/khugepaged: fix race with folio split/free using temporary reference mm: add CONFIG_PAGE_BLOCK_ORDER to select page block order mmu_notifiers: remove leftover stub macros selftests/mm: deduplicate test names in madv_populate kcov: rust: add flags for KCOV with Rust mm: rust: make CONFIG_MMU ifdefs more narrow mmu_gather: move tlb flush for VM_PFNMAP/VM_MIXEDMAP vmas into free_pgtables() mm/damon/Kconfig: enable CONFIG_DAMON by default ...
2025-06-02PCI: j721e: Fix host/endpoint dependenciesArnd Bergmann
The j721e driver has a single platform driver that can be built-in or a loadable module, but it calls two separate backend drivers depending on whether it is a host or endpoint. If the two modes are not the same, we can end up with a situation where the built-in pci-j721e driver tries to call the modular host or endpoint driver, which causes a link failure: ld.lld-21: error: undefined symbol: cdns_pcie_ep_setup >>> referenced by pci-j721e.c >>> drivers/pci/controller/cadence/pci-j721e.o:(j721e_pcie_probe) in archive vmlinux.a ld.lld-21: error: undefined symbol: cdns_pcie_host_setup >>> referenced by pci-j721e.c >>> drivers/pci/controller/cadence/pci-j721e.o:(j721e_pcie_probe) in archive vmlinux.a Rework the dependencies so that the 'select' is done by the common Kconfig symbol, based on which of the two are enabled. Effectively this means that having one built-in makes the other either built-in or disabled, but all configurations will now build. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com> Link: https://patch.msgid.link/20250423162523.2060405-1-arnd@kernel.org
2025-06-02PCI: j721e: Add support to build as a loadable moduleSiddharth Vadapalli
The 'pci-j721e.c' driver is the application/glue/wrapper driver for the Cadence PCIe Controllers on TI SoCs. Implement support for building it as a loadable module. Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Link: https://patch.msgid.link/20250417124408.2752248-5-s-vadapalli@ti.com
2025-06-02PCI: cadence-ep: Introduce cdns_pcie_ep_disable() helper for cleanupSiddharth Vadapalli
Introduce the helper function cdns_pcie_ep_disable() which will undo the configuration performed by cdns_pcie_ep_setup(). Also, export it for use by the existing callers of cdns_pcie_ep_setup(), thereby allowing them to cleanup on their exit path. Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Link: https://patch.msgid.link/20250417124408.2752248-4-s-vadapalli@ti.com
2025-06-02PCI: cadence-host: Introduce cdns_pcie_host_disable() helper for cleanupSiddharth Vadapalli
Introduce the helper function cdns_pcie_host_disable() which will undo the configuration performed by cdns_pcie_host_setup(). Also, export it for use by existing callers of cdns_pcie_host_setup(), thereby allowing them to cleanup on their exit path. Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Link: https://patch.msgid.link/20250417124408.2752248-3-s-vadapalli@ti.com
2025-06-02PCI: cadence: Add support to build pcie-cadence library as a kernel moduleKishon Vijay Abraham I
Currently, the Cadence PCIe controller driver can be built as a built-in module only. Since PCIe functionality is not a necessity for booting, add support to build the Cadence PCIe driver as a loadable module as well. Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com> Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Link: https://patch.msgid.link/20250417124408.2752248-2-s-vadapalli@ti.com
2025-06-02PCI: Remove unnecessary linesplit in __pci_setup_bridge()Ilpo Järvinen
No need to split the line in __pci_setup_bridge() as it is way shorter than the limit. Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://lore.kernel.org/r/20250404124547.51185-1-ilpo.jarvinen@linux.intel.com
2025-06-02Merge tag 'input-for-v6.16-rc0' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - support for game controllers requiring delayed initialization packets, such as ByoWave Proteus, in xpad driver - a change to atkbd driver to not reset the keyboard on Loongson devices - tweaks to gpio-keys and matrix_keypad drivers - fixes to documentation for Amiga joysticks - a fix to ims-pcu driver to better handle malformed firmware * tag 'input-for-v6.16-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: ims-pcu - check record size in ims_pcu_flash_firmware() Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT Input: amijoy - make headings compliant w/ guidelines in documentation Input: amijoy - fix grammar in documentation Input: amijoy - fix Amiga 4-joystick adapter pinout in documentation Input: amijoy - fix broken table formatting in documentation Input: atkbd - do not reset keyboard by default on Loongson Input: xpad - send LED and auth done packets to all Xbox One controllers Input: xpad - add the ByoWave Proteus controller Input: xpad - allow delaying init packets MAINTAINERS: update dlg,da72??.txt to yaml dt-bindings: input: convert dlg,da7280.txt to dt-schema dt-bindings: input: touchscreen: edt-ft5x06: use unevaluatedProperties Input: snvs_pwrkey - support power-off-time-sec dt-bindings: crypto: fsl,sec-v4.0-mon: Add "power-off-time-sec" Input: matrix_keypad - detect change during scan Input: matrix_keypad - add function for reading row state
2025-06-02Merge tag 'mtd/for-6.16' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD updates from Miquel Raynal: "A big core MTD change is the introduction of a new class to always register a master device. This is a problem that has been there forever: the "master" device was not always present depending on a number of heuristics such as the presence of fixed partitions and the absence of a Kconfig symbol to force its presence. This was a problem for runtime PM operations which might not have the "master" device available in all situation. The SPI NAND subsystem has seen the introduction of DTR operations (the equivalent of DDR transfers), which involved quite a few preparation patches for clarifying macro names. In the raw NAND subsystem, the brcmnand driver has been "fixed" for old legacy SoCs with an update of the ->exec_op() hook, there has been the introduction of a new controller driver named Loongson-1, and the Qualcomm driver has received quite a few misc fixes as well as a new compatible. Finally, Macornix SPI NOR entries have been cleaned-up and some SFDP table fixups for Macronix MX25L3255E have been merged. Aside from this, there is the usual load of misc improvement, fixes, and yaml conversion" * tag 'mtd/for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (42 commits) mtd: rawnand: brcmnand: legacy exec_op implementation mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk mtd: nand: brcmnand: fix NAND timeout when accessing eMMC mtd: nand: sunxi: Add randomizer configuration before randomizer enable mtd: spinand: esmt: fix id code for F50D1G41LB mtd: rawnand: brcmnand: remove unused parameters mtd: core: always create master device mtd: rawnand: loongson1: Fix inconsistent refcounting in ls1x_nand_chip_init() mtd: rawnand: loongson1: Fix error code in ls1x_nand_dma_transfer() mtd: rawnand: qcom: Fix read len for onfi param page mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() mtd: rawnand: qcom: Pass 18 bit offset from NANDc base to BAM base dt-bindings: mtd: qcom,nandc: Document the SDX75 NAND controller mtd: bcm47xxnflash: Add error handling for bcm47xxnflash_ops_bcm4706_ctl_cmd() mtd: rawnand: Use non-hybrid PCI devres API mtd: nand: ecc-mxic: Fix use of uninitialized variable ret mtd: spinand: winbond: Add support for W35N02JW and W35N04JW chips mtd: spinand: winbond: Add octal support mtd: spinand: winbond: Add support for W35N01JW in single mode mtd: spinand: winbond: Rename DTR variants ...
2025-06-02Merge tag 'rpmsg-v6.16' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: - Remove some dead and unused code from core and virtio modules - Improve the error messages from the Qualcomm SMD driver and initialize an uninitialized variable in the send path * tag 'rpmsg-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() rpmsg: qcom_smd: Improve error handling for qcom_smd_parse_edge rpmsg: Remove unused method pointers *send_offchannel rpmsg: virtio: Remove uncallable offchannel functions rpmsg: core: Remove deadcode
2025-06-02Merge tag 'rproc-v6.16' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: - Fix resource cleanup in the remoteproc attach error handling code paths - Refactor the various TI K3 drivers to extract and reuse common code between them - Add support in the i.MX remoteproc driver for determining from the firmware if Linux should wait on a "firmware ready" signal at startup - Improve the Xilinx R5F power down mechanism to handle use cases where this is shared with other entities in the system * tag 'rproc-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (46 commits) remoteproc: k3: Refactor release_tsp() functions into common driver remoteproc: k3: Refactor reserved_mem_init() functions into common driver remoteproc: k3: Refactor mem_release() functions into common driver remoteproc: k3: Refactor of_get_memories() functions into common driver remoteproc: k3: Refactor .da_to_va rproc ops into common driver remoteproc: k3: Refactor .get_loaded_rsc_table ops into common driver remoteproc: k3: Refactor .detach rproc ops into common driver remoteproc: k3: Refactor .attach rproc ops into common driver remoteproc: k3: Refactor .stop rproc ops into common driver remoteproc: k3: Refactor .start rproc ops into common driver remoteproc: k3: Refactor .unprepare rproc ops into common driver remoteproc: k3: Refactor .prepare rproc ops into common driver remoteproc: k3-dsp: Assert local reset during .prepare callback remoteproc: k3-dsp: Don't override rproc ops in IPC-only mode remoteproc: k3: Refactor rproc_request_mbox() implementations into common driver remoteproc: k3-m4: Ping the mbox while acquiring the channel remoteproc: k3: Refactor rproc_release() implementation into common driver remoteproc: k3-m4: Introduce central function to release rproc from reset remoteproc: k3-dsp: Correct Reset deassert logic for devices w/o lresets remoteproc: k3: Refactor rproc_reset() implementation into common driver ...
2025-06-02Merge tag 'mailbox-v6.16' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox Pull mailbox updates from Jassi Brar: "Core: - misc cleanup sophgo: - add driver for CV18XX series qcom: - add SM7150 APCS compatible - apcs: added separate clock node imx: - fix tx doorbell send microchip: - misc compile option fix mediatek: - Refine GCE_GCTL_VALUE setting" * tag 'mailbox-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: mailbox: qcom-apcs-ipc: Assign OF node to clock controller child device dt-bindings: mailbox: qcom,apcs: Add separate node for clock-controller dt-bindings: mailbox: qcom: Add the SM7150 APCS compatible mailbox: sophgo: add mailbox driver for CV18XX series SoC dt-bindings: mailbox: add Sophgo CV18XX series SoC mailbox: Use guard/scoped_guard for spinlock mailbox: Use guard/scoped_guard for con_mutex mailbox: Remove devm_mbox_controller_unregister mailbox: Propagate correct error return value mailbox: Not protect module_put with spin_lock_irqsave mailbox: Use dev_err when there is error mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting mailbox: imx: Fix TXDB_V2 sending mailbox: mchp-ipc-sbi: Fix COMPILE_TEST build error
2025-06-02Merge tag 'nand/for-6.16' into mtd/nextMiquel Raynal
The SPI NAND subsystem has seen the introduction of DTR operations (the equivalent of DDR transfers), which involved quite a few preparation patches for clarifying macro names. In the raw NAND subsystem, the brcmnand driver has been "fixed" for old legacy SoCs with an update of the ->exec_op() hook, there has been the introduction of a new controller driver named Loongson-1, and the Qualcomm driver has received quite a few misc fixes as well as a new compatible. Aside from this, there is the usual load of misc improvement and fixes.
2025-06-02Merge tag 'spi-nor/for-6.16' into mtd/nextMiquel Raynal
SPI NOR changes for 6.16 Notable changes: - Cleanup some Macronix flash entries. - Add SFDP table fixups for Macronix MX25L3255E.
2025-06-02pwm: axi-pwmgen: fix missing separate external clockDavid Lechner
Add proper support for external clock to the AXI PWM generator driver. In most cases, the HDL for this IP block is compiled with the default ASYNC_CLK_EN=1. With this option, there is a separate external clock that drives the PWM output separate from the peripheral clock. So the driver should be enabling the "axi" clock to power the peripheral and the "ext" clock to drive the PWM output. When ASYNC_CLK_EN=0, the "axi" clock is also used to drive the PWM output and there is no "ext" clock. Previously, if there was a separate external clock, users had to specify only the external clock and (incorrectly) omit the AXI clock in order to get the correct operating frequency for the PWM output. The devicetree bindings are updated to fix this shortcoming and this patch changes the driver to match the new bindings. To preserve compatibility with any existing dtbs that specify only one clock, we don't require the clock name on the first clock. Fixes: 41814fe5c782 ("pwm: Add driver for AXI PWM generator") Cc: stable@vger.kernel.org Acked-by: Nuno Sá <nuno.sa@analog.com> Reviewed-by: Trevor Gamblin <tgamblin@baylibre.com> Signed-off-by: David Lechner <dlechner@baylibre.com> Link: https://lore.kernel.org/r/20250529-pwm-axi-pwmgen-add-external-clock-v3-3-5d8809a7da91@baylibre.com Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2025-06-02PCI: WARN (not BUG()) when we fail to assign optional resourcesIlpo Järvinen
Resource fitting/assignment code checks if there's a remainder in add_list (aka. realloc_head in the inner functions) using BUG_ON(). This problem typically results in a mere PCI device resource assignment failure which does not warrant using BUG_ON(). The machine could well come up usable even if this condition occurs because the realloc_head relates to resources which are optional anyway. Change BUG_ON() to WARN_ON_ONCE() and free the list if it's not empty. [bhelgaas: subject] Reported-by: Tudor Ambarus <tudor.ambarus@linaro.org> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://lore.kernel.org/linux-pci/5f103643-5e1c-43c6-b8fe-9617d3b5447c@linaro.org Link: https://lore.kernel.org/r/20250511215223.7131-1-ilpo.jarvinen@linux.intel.com
2025-06-02dm-table: check BLK_FEAT_ATOMIC_WRITES inside limits_lockBenjamin Marzinski
dm_set_device_limits() should check q->limits.features for BLK_FEAT_ATOMIC_WRITES while holding q->limits_lock, like it does for the rest of the queue limits. Fixes: b7c18b17a173 ("dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits") Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-06-02spi: spi-qpic-snand: document the limited bit error reporting capabilityGabor Juhos
The QPIC hardware is not capable of reporting the exact number of the corrected bit errors, it only reports the number of the corrected bytes. Document this behaviour in the code, and also issue a warning message to inform the user about it. No functional changes. Signed-off-by: Gabor Juhos <j4g8y7@gmail.com> Link: https://patch.msgid.link/20250527-qpic-snand-limited-biterr-caps-v1-1-61f7cf87be1e@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-06-02drm/i915/guc: Handle race condition where wakeref count drops below 0Jesus Narvaez
There is a rare race condition when preparing for a reset where guc_lrc_desc_unpin() could be in the process of deregistering a context while a different thread is scrubbing outstanding contexts and it alters the context state and does a wakeref put. Then, if there is a failure with deregister_context(), a second wakeref put could occur. As a result the wakeref count could drop below 0 and fail an INTEL_WAKEREF_BUG_ON() check. Therefore if there is a failure with deregister_context(), undo the context state changes and do a wakeref put only if the context was set to be destroyed earlier. v2: Expand comment to better explain change. (Daniele) v3: Removed addition to the original comment. (Daniele) Fixes: 2f2cc53b5fe7 ("drm/i915/guc: Close deregister-context race against CT-loss") Signed-off-by: Jesus Narvaez <jesus.narvaez@intel.com> Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Cc: Alan Previn <alan.previn.teres.alexis@intel.com> Cc: Anshuman Gupta <anshuman.gupta@intel.com> Cc: Mousumi Jana <mousumi.jana@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Matt Roper <matthew.d.roper@intel.com> Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Signed-off-by: John Harrison <John.C.Harrison@Intel.com> Link: https://lore.kernel.org/r/20250528230551.1855177-1-jesus.narvaez@intel.com (cherry picked from commit f36a75aba1c3176d177964bca76f86a075d2943a) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2025-06-02drm/i915/psr: Fix using wrong mask in REG_FIELD_PREPJouni Högander
Wrong mask is used in PORT_ALPM_LFPS_CTL_FIRST_LFPS_HALF_CYCLE_DURATION and PORT_ALPM_LFPS_CTL_LAST_LFPS_HALF_CYCLE_DURATION. Fixes: 295099580f04 ("drm/i915/psr: Add missing ALPM AUX-Less register definitions") Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://lore.kernel.org/r/20250526120512.1702815-12-jouni.hogander@intel.com (cherry picked from commit 8097128a40ff378761034ec72cdbf6f46e466dc0) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2025-06-02drm/i915/guc: Check if expecting reply before decrementing ↵Jesus Narvaez
outstanding_submission_g2h When sending a H2G message where a reply is expected in guc_submission_send_busy_loop(), outstanding_submission_g2h is incremented before the send. However, if there is an error sending the message, outstanding_submission_g2h is decremented without checking if a reply is expected. Therefore, check if reply is expected when there is a failure before decrementing outstanding_submission_g2h. Fixes: 2f2cc53b5fe7 ("drm/i915/guc: Close deregister-context race against CT-loss") Signed-off-by: Jesus Narvaez <jesus.narvaez@intel.com> Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Cc: Alan Previn <alan.previn.teres.alexis@intel.com> Cc: Anshuman Gupta <anshuman.gupta@intel.com> Cc: Mousumi Jana <mousumi.jana@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Matt Roper <matthew.d.roper@intel.com> Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Signed-off-by: John Harrison <John.C.Harrison@Intel.com> Link: https://lore.kernel.org/r/20250514225224.4142684-1-jesus.narvaez@intel.com (cherry picked from commit a6a26786f22a4ab0227bcf610510c4c9c2df0808) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2025-06-02s390/crypto: Select crypto engine in Kconfig when PAES is chosenHarald Freudenberger
The s390 PAES crypto algorithm has a dependency to the crypto engine. So enable the crypto engine via SELECT CRYPTO_ENGINE in drivers/crypto/Kconfig when CRYPTO_PAES_S390 is chosen. Fixes: 6cd87cb5ef6c ("s390/crypto: Rework protected key AES for true asynch support") Reported-by: Thomas Huth <thuth@redhat.com> Closes: https://lore.kernel.org/linux-s390/f958f869-8da3-48d9-a118-f3cf9a9ea75c@redhat.com/ Reviewed-by: Holger Dengler <dengler@linux.ibm.com> Signed-off-by: Harald Freudenberger <freude@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Link: https://lore.kernel.org/r/20250528083032.224430-1-freude@linux.ibm.com Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2025-06-01Merge branch 'next' into for-linusDmitry Torokhov
Prepare input updates for 6.16 merge window.
2025-06-02Merge tag 'amd-drm-fixes-6.16-2025-05-29' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-6.16-2025-05-29: amdgpu: - UserQ fixes - SMU 13.x fixes - VCN fixes - JPEG fixes - Misc cleanups - runtime pm fix - DCN 4.0.1 fixes - Misc display fixes - ISP fix - VRAM manager fix - RAS fixes amdkfd: - SVM fix - Misc cleanups - Ref leak fix - WPTR BO fix radeon: - Misc cleanups Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://lore.kernel.org/r/20250529205215.6790-1-alexander.deucher@amd.com
2025-06-02rtc: mt6359: Add mt6357 supportAlexandre Mergnat
The MT6357 PMIC contains the same RTC as MT6358 which allows to add support for it trivially by just complementing the list of compatibles. Signed-off-by: Alexandre Mergnat <amergnat@baylibre.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Acked-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Tested-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Link: https://lore.kernel.org/r/20250428-rtc-mt6357-v1-1-31f673b0a723@baylibre.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-06-02rtc: test: Test date conversion for dates starting in 1900Uwe Kleine-König
While the RTC framework intends to only handle dates after 1970 for consumers, time conversion must also work for earlier dates to cover e.g. storing dates beyond an RTC's range_max. This is most relevant for the rtc-mt6397 driver that has range_min = RTC_TIMESTAMP_BEGIN_1900; range_max = mktime64(2027, 12, 31, 23, 59, 59); and so needs working support for timestamps in 1900 starting in less than three years. So shift the tested interval of timestamps to also cover years 1900 to 1970. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Signed-off-by: Alexandre Mergnat <amergnat@baylibre.com> Link: https://lore.kernel.org/r/20250428-enable-rtc-v4-5-2b2f7e3f9349@baylibre.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-06-02rtc: test: Also test time and wday outcome of rtc_time64_to_tm()Uwe Kleine-König
To cover calculation of the time and wday in the rtc kunit test also check tm_hour, tm_min, tm_sec and tm_wday of the rtc_time calculated by rtc_time64_to_tm(). There are no surprises, the two tests making use of rtc_time64_to_tm_test_date_range() continue to succeed. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Signed-off-by: Alexandre Mergnat <amergnat@baylibre.com> Link: https://lore.kernel.org/r/20250428-enable-rtc-v4-4-2b2f7e3f9349@baylibre.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-06-02rtc: test: Emit the seconds-since-1970 value instead of days-since-1970Uwe Kleine-König
This is easier to handle because you can just consult date(1) to convert between a seconds-since-1970 value and a date string: $ date --utc -d @3661 Thu Jan 1 01:01:01 AM UTC 1970 $ date -d "Jan 1 12:00:00 AM UTC 1900" +%s -2208988800 The intended side effect is that this prepares the test for dates before 1970. The division of a negative value by 86400 doesn't result in the desired days-since-1970 value as e.g. secs=-82739 should map to days=-1. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Signed-off-by: Alexandre Mergnat <amergnat@baylibre.com> Link: https://lore.kernel.org/r/20250428-enable-rtc-v4-3-2b2f7e3f9349@baylibre.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-06-02rtc: Fix offset calculation for .start_secs < 0Alexandre Mergnat
The comparison rtc->start_secs > rtc->range_max has a signed left-hand side and an unsigned right-hand side. So the comparison might become true for negative start_secs which is interpreted as a (possibly very large) positive value. As a negative value can never be bigger than an unsigned value the correct representation of the (mathematical) comparison rtc->start_secs > rtc->range_max in C is: rtc->start_secs >= 0 && rtc->start_secs > rtc->range_max Use that to fix the offset calculation currently used in the rtc-mt6397 driver. Fixes: 989515647e783 ("rtc: Add one offset seconds to expand RTC range") Signed-off-by: Alexandre Mergnat <amergnat@baylibre.com> Reviewed-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Link: https://lore.kernel.org/r/20250428-enable-rtc-v4-2-2b2f7e3f9349@baylibre.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-06-02rtc: Make rtc_time64_to_tm() support dates before 1970Alexandre Mergnat
Conversion of dates before 1970 is still relevant today because these dates are reused on some hardwares to store dates bigger than the maximal date that is representable in the device's native format. This prominently and very soon affects the hardware covered by the rtc-mt6397 driver that can only natively store dates in the interval 1900-01-01 up to 2027-12-31. So to store the date 2028-01-01 00:00:00 to such a device, rtc_time64_to_tm() must do the right thing for time=-2208988800. Signed-off-by: Alexandre Mergnat <amergnat@baylibre.com> Reviewed-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Link: https://lore.kernel.org/r/20250428-enable-rtc-v4-1-2b2f7e3f9349@baylibre.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-06-02rtc: pcf8563: fix wrong alarm registerTroy Mitchell
When the regmap framework was introduced to this driver, the PCF8563_REG_AMN register within the set_alarm function was incorrectly changed to PCF8563_REG_SC. The PCF8563_REG_SC register is the seconds register. This caused alarm values to be written to the seconds register when an alarm was set. Which means the alarm would not trigger as expected and the seconds register would be overwritten with an incorrect value. Signed-off-by: Troy Mitchell <troymitchell988@gmail.com> Link: https://lore.kernel.org/r/20250531-pcf8563-fix-alarm-v2-1-cac4b1716167@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-06-01rtc: rzn1: support input frequencies other than 32768HzWolfram Sang
When using the SCMP mode instead of SUBU, this RTC can also support other input frequencies than 32768Hz. Also, upcoming SoCs will only support SCMP. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://lore.kernel.org/r/20250526095801.35781-8-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-06-01rtc: rzn1: Disable controller before initializationWolfram Sang
Datasheet says that the controller must be disabled before setting up either SUBU or SCMP. This did not matter so far because the driver only supported SUBU which was the default, too. It is good practice to follow datasheet recommendations, though. It will also be needed because SCMP mode will be added in a later patch. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://lore.kernel.org/r/20250526095801.35781-7-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
generated by cgit (git 2.34.1) at 2025-07-15 14:37:39 +0000