summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-02-03wifi: iwlwifi: mld: cancel mlo_scan_start_wkMiri Korenblit
mlo_scan_start_wk is not canceled on disconnection. In fact, it is not canceled anywhere except in the restart cleanup, where we don't really have to. This can cause an init-after-queue issue: if, for example, the work was queued and then drv_change_interface got executed. This can also cause use-after-free: if the work is executed after the vif is freed. Fixes: 9748ad82a9d9 ("wifi: iwlwifi: defer MLO scan after link activation") Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260129212650.a36482a60719.I5bf64a108ca39dacb5ca0dcd8b7258a3ce8db74c@changeid
2026-02-03PCI: s32g: Skip Root Port removal during successVincent Guittot
Currently, s32g_pcie_parse_ports() exercises the 'err_port' path even during the success case. This results in ports getting deleted after successful parsing of Root Ports. Hence, skip the removal of Root Ports during success. Fixes: 5cbc7d3e316e ("PCI: s32g: Add NXP S32G PCIe controller driver (RC)") Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org> [mani: reworded subject and description] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260202151050.1446165-1-vincent.guittot@linaro.org
2026-02-03wifi: brcmsmac: phy: Remove unreachable error handling codeIngyu Jang
wlc_phy_txpwr_srom_read_lcnphy() in wlc_phy_attach_lcnphy() always returns true, making the error handling code unreachable. Change the function's return type to void and remove the dead code, similar to the cleanup done for wlc_phy_txpwr_srom_read_nphy() in commit 47f0e32ffe4e ("wifi: brcmsmac: phy: Remove unreachable code"). Signed-off-by: Ingyu Jang <ingyujang25@korea.ac.kr> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260131172355.3367673-1-ingyujang25@korea.ac.kr Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-02-03rust_binder: return p from rust_binder_transaction_target_node()Alice Ryhl
Somehow this got changed to NULL when I ported this to upstream it. No idea how that happened. Reported-by: Carlos Llamas <cmllamas@google.com> Closes: https://lore.kernel.org/r/aXkEiC1sGOGfDuzI@google.com Fixes: c1ea31205edf ("rust_binder: add binder_transaction tracepoint") Signed-off-by: Alice Ryhl <aliceryhl@google.com> Acked-by: Carlos Llamas <cmllamas@google.com> Link: https://patch.msgid.link/20260128-binder-fix-target-node-null-v1-1-78d198ef55a5@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-02-03binderfs: fix ida_alloc_max() upper boundCarlos Llamas
The 'max' argument of ida_alloc_max() takes the maximum valid ID and not the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor would exceed the limits of minor numbers (20-bits). Fix this off-by-one error by subtracting 1 from the 'max'. Cc: stable@vger.kernel.org Fixes: 3ad20fe393b3 ("binder: implement binderfs") Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://patch.msgid.link/20260127235545.2307876-2-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-02-03rust_binderfs: fix ida_alloc_max() upper boundCarlos Llamas
The 'max' argument of ida_alloc_max() takes the maximum valid ID and not the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor would exceed the limits of minor numbers (20-bits). Fix this off-by-one error by subtracting 1 from the 'max'. Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/r/202512181203.IOv6IChH-lkp@intel.com/ Signed-off-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Link: https://patch.msgid.link/20260127235545.2307876-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-02-03drivers: android: binder: Update ARef imports from sync::arefShankari Anand
Update call sites in binder files to import `ARef` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. Suggested-by: Benno Lossin <lossin@kernel.org> Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand <shankari.ak0208@gmail.com> Acked-by: Alice Ryhl <aliceryhl@google.com> Link: https://patch.msgid.link/20260102202714.184223-2-shankari.ak0208@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-02-03rust_binder: fix needless borrow in context.rsShivam Kalra
Clippy warns about a needless borrow in context.rs: error: this expression creates a reference which is immediately dereferenced by the compiler --> drivers/android/binder/context.rs:141:18 | 141 | func(&proc); | ^^^^^ help: change this to: `proc` Remove the unnecessary borrow to satisfy clippy and improve code cleanliness. No functional change. Signed-off-by: Shivam Kalra <shivamklr@cock.li> Acked-by: Alice Ryhl <aliceryhl@google.com> Link: https://patch.msgid.link/20260130182842.217821-1-shivamklr@cock.li Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-02-03net: phy: remove modalias-based mdio bus matchingHeiner Kallweit
Last user dsa_loop has been migrated away from modalias-based matching, so we can remove this feature now. It was the only user of MDIO_NAME_SIZE, so remove also this constant. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/ce1c6df0-4785-4b28-8322-32dc6bceea18@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-03net: dsa: loop: remove MDIO device modaliasHeiner Kallweit
This change is a prerequisite for removing the MDIO device modalias, as dsa_loop is the only user. Switch from modalias to a custom bus match function. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Reviewed-by: Vladimir Oltean <olteanv@gmail.com> Tested-by: Vladimir Oltean <olteanv@gmail.com> Link: https://patch.msgid.link/15a4318f-50b5-4df5-874e-e387ee070a9d@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-03net: ethernet: adi: make name member of struct adin1110_cfg a pointerHeiner Kallweit
Primary reason for this change is to remove the misuse of MDIO_NAME_SIZE here, so that this constant can be removed in a follow-up patch. Use case here is simply a chip name w/o any relationship to a MDIO device. Also there's no need to reserve a longer char array, so make the name a pointer. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/61bc14fa-eed3-43b6-ae40-b98063e81578@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-03revocable: Add KUnit test for concurrent accessTzung-Bi Shih
Add a test case to verify correct synchronization between concurrent readers and a revocation. The test setup involves: 1. Consumer 1 enters the critical section (SRCU read lock) and verifies access to the resource. 2. Provider attempts to revoke the resource. This should block until Consumer 1 releases the lock. 3. Consumer 2 attempts to enter the critical section while revocation is pending. It should see the resource as revoked (NULL). 4. Consumer 1 exits, allowing the revocation to complete. This ensures that the SRCU mechanism correctly enforces grace periods and that new readers are properly prevented from accessing the resource once revocation has begun. A way to run the test: $ ./tools/testing/kunit/kunit.py run \ --kconfig_add CONFIG_REVOCABLE_KUNIT_TEST=y \ --kconfig_add CONFIG_PROVE_LOCKING=y \ --kconfig_add CONFIG_DEBUG_KERNEL=y \ --kconfig_add CONFIG_DEBUG_INFO=y \ --kconfig_add CONFIG_DEBUG_INFO_DWARF5=y \ --kconfig_add CONFIG_KASAN=y \ --kconfig_add CONFIG_DETECT_HUNG_TASK=y \ --kconfig_add CONFIG_DEFAULT_HUNG_TASK_TIMEOUT="10" \ --arch=x86_64 --raw_output=all \ revocable_test Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org> Link: https://patch.msgid.link/20260129143733.45618-5-tzungbi@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-02-03revocable: fix SRCU index corruption by requiring caller-provided storageTzung-Bi Shih
The struct revocable handle stores the SRCU read-side index (idx) for the duration of a resource access. If multiple threads share the same struct revocable instance, they race on writing to the idx field, corrupting the SRCU state and potentially causing unsafe unlocks. Refactor the API to replace revocable_alloc()/revocable_free() with revocable_init()/revocable_deinit(). This change requires the caller to provide the storage for struct revocable. By moving storage ownership to the caller, the API ensures that concurrent users maintain their own private idx storage, eliminating the race condition. Reported-by: Johan Hovold <johan@kernel.org> Closes: https://lore.kernel.org/all/20260124170535.11756-4-johan@kernel.org/ Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org> Link: https://patch.msgid.link/20260129143733.45618-4-tzungbi@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-02-03revocable: Add KUnit test for provider lifetime racesTzung-Bi Shih
Add a test to verify that revocable_alloc() correctly handles race conditions where the provider is being released. The test covers three scenarios: 1. Allocating from a NULL provider. 2. Allocating from a provider that has been detached (pointer is NULL). 3. Allocating from a provider that is in the process of destruction (refcount is 0), simulating a race between revocable_alloc() and revocable_provider_release(). A way to run the test: $ ./tools/testing/kunit/kunit.py run \ --kconfig_add CONFIG_REVOCABLE_KUNIT_TEST=y \ --kconfig_add CONFIG_PROVE_LOCKING=y \ --kconfig_add CONFIG_DEBUG_KERNEL=y \ --kconfig_add CONFIG_DEBUG_INFO=y \ --kconfig_add CONFIG_DEBUG_INFO_DWARF5=y \ --kconfig_add CONFIG_KASAN=y \ --kconfig_add CONFIG_DETECT_HUNG_TASK=y \ --kconfig_add CONFIG_DEFAULT_HUNG_TASK_TIMEOUT="10" \ --arch=x86_64 --raw_output=all \ revocable_test Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org> Link: https://patch.msgid.link/20260129143733.45618-3-tzungbi@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-02-03revocable: Fix races in revocable_alloc() using RCUTzung-Bi Shih
There are two race conditions when allocating a revocable instance: 1. After a struct revocable_provider is revoked, the caller might still hold a dangling pointer to it. A subsequent call to revocable_alloc() can trigger a use-after-free. 2. If revocable_provider_release() runs concurrently with revocable_alloc(), the memory of struct revocable_provider can be accessed during or after kfree(). To fix these: - Manage the lifetime of struct revocable_provider using RCU. Annotate pointers to it with __rcu and use kfree_rcu() for deallocation. - Update revocable_alloc() to safely acquire a reference using RCU primitives. - Update revocable_provider_revoke() to take a double pointer (`**rp`). It atomically NULLs out the caller's pointer before starting revocation. This prevents the caller from holding a dangling pointer. - Drop devm_revocable_provider_alloc(). The devm-managed model cannot support the required double-pointer semantic for safe pointer nulling. Reported-by: Johan Hovold <johan@kernel.org> Closes: https://lore.kernel.org/all/aXdy-b3GOJkzGqYo@hovoldconsulting.com/ Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org> Link: https://patch.msgid.link/20260129143733.45618-2-tzungbi@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-02-03Input: apbps2 - fix comment style and typosMicah Ostrow
Capitalize comment starts to match kernel coding style. Fix spelling: "reciever" -> "receiver" Fix grammar: "it's" (contraction of "it is") -> "its" (possessive) Remove uncertainty from "Clear error bits?" comment. Compile tested only. Signed-off-by: Micah Ostrow <bluefox9516@gmail.com> Link: https://patch.msgid.link/20260127181735.57132-1-bluefox9516@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-02-03drm/panel: ilitek-ili9882t: Remove duplicate initializers in tianma_il79900a_dscNathan Chancellor
Clang warns (or errors with CONFIG_WERROR=y / W=e): drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:95:16: error: initializer overrides prior initialization of this subobject [-Werror,-Winitializer-overrides] 95 | .vbr_enable = 0, | ^ drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:90:16: note: previous initialization is here 90 | .vbr_enable = false, | ^~~~~ drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:97:19: error: initializer overrides prior initialization of this subobject [-Werror,-Winitializer-overrides] 97 | .rc_model_size = DSC_RC_MODEL_SIZE_CONST, | ^~~~~~~~~~~~~~~~~~~~~~~ include/drm/display/drm_dsc.h:22:38: note: expanded from macro 'DSC_RC_MODEL_SIZE_CONST' 22 | #define DSC_RC_MODEL_SIZE_CONST 8192 | ^~~~ drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:91:19: note: previous initialization is here 91 | .rc_model_size = DSC_RC_MODEL_SIZE_CONST, | ^~~~~~~~~~~~~~~~~~~~~~~ include/drm/display/drm_dsc.h:22:38: note: expanded from macro 'DSC_RC_MODEL_SIZE_CONST' 22 | #define DSC_RC_MODEL_SIZE_CONST 8192 | ^~~~ drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:132:25: error: initializer overrides prior initialization of this subobject [-Werror,-Winitializer-overrides] 132 | .initial_scale_value = 32, | ^~ drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:126:25: note: previous initialization is here 126 | .initial_scale_value = 32, | ^~ drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:133:20: error: initializer overrides prior initialization of this subobject [-Werror,-Winitializer-overrides] 133 | .nfl_bpg_offset = 3511, | ^~~~ drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:108:20: note: previous initialization is here 108 | .nfl_bpg_offset = 1402, | ^~~~ GCC would warn about this in the same manner but its version, -Woverride-init, is disabled for a normal kernel build in scripts/Makefile.warn. For clang, -Wextra in drivers/gpu/drm/Makefile turns it back but GCC respects turning it off earlier in the command line. Of all the duplicate fields in the initializer, only nfl_bpg_offset is a different value. Clear up the duplicate initializers, keeping the 'false' value for .vbr_enable, as it is bool, and the second value for .nfl_bpg_offset, assuming it is the correct one since it was the one tested in the original change. Fixes: 65ce1f5834e9 ("drm/panel: ilitek-ili9882t: Switch Tianma TL121BVMS07 to DSC 120Hz mode") Signed-off-by: Nathan Chancellor <nathan@kernel.org> Link: https://patch.msgid.link/20260114-panel-ilitek-ili9882t-fix-override-init-v1-1-1d69a2b096df@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
2026-02-03media: pci: mg4b: Use IRQF_NO_THREADSebastian Andrzej Siewior
The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke other interrupt handlers and this supposed to happen from hard interrupt context. Use IRQF_NO_THREAD to forbid forced-threading. Fixes: 0ab13674a9bd1 ("media: pci: mgb4: Added Digiteq Automotive MGB4 driver") Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260128095540.863589-21-bigeasy@linutronix.de
2026-02-02net: stmmac: handle integrated PCS phy_intf_sel separatelyRussell King (Oracle)
The dwmac core has no support for SGMII without using its integrated PCS. Thus, PHY_INTF_SEL_SGMII is only supported when this block is present, and it makes no sense for stmmac_get_phy_intf_sel() to decode this. None of the platform glue users that use stmmac_get_phy_intf_sel() directly accept PHY_INTF_SEL_SGMII as a valid mode. Check whether a PCS will be used by the driver for the interface mode, and if it is the integrated PCS, query the integrated PCS for the phy_intf_sel_i value to use. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1vlmOa-00000006zvB-1fIe@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: stmmac: move most PCS register definitions to stmmac_pcs.cRussell King (Oracle)
Move most of the PCS register offset definitions to stmmac_pcs.c. Since stmmac_pcs.c only ever passes zero into the register offset macros, remove that ability, making them simple constant integer definitions. Add appropriate descriptions of the registers, pointing out their similarity with their IEEE 802.3 counterparts. Make use of the BMSR definitions for the GMAC_AN_STATUS register and remove the driver private versions. Note that BMSR_LSTATUS is non-low-latching, unlike it's 802.3z counterpart. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1vlmOV-00000006zv5-1CwO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: stmmac: clear half-duplex caps where unsupportedRussell King (Oracle)
Where a core supports hardware features, but does not indicate support for half-duplex, clear phylink's half-duplex 1G, 100M and 10M capability bits to disallow half-duplex operation and advertisement of these link modes. This will avoid the need for special code in the PCS driver to do this based on the ESTATUS register bits, as the support in the PCS is dependent on the same synthesis choice as the MAC core. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1vlmOQ-00000006zuz-0ffN@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: spacemit: k1-emac: fix jumbo frame supportTomas Hlavacek
The driver never programs the MAC frame size and jabber registers, causing the hardware to reject frames larger than the default 1518 bytes even when larger DMA buffers are allocated. Program MAC_MAXIMUM_FRAME_SIZE, MAC_TRANSMIT_JABBER_SIZE, and MAC_RECEIVE_JABBER_SIZE based on the configured MTU. Also fix the maximum buffer size from 4096 to 4095, since the descriptor buffer size field is only 12 bits. Account for double VLAN tags in frame size calculations. Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC") Cc: stable@vger.kernel.org Signed-off-by: Tomas Hlavacek <tmshlvck@gmail.com> Link: https://patch.msgid.link/20260130102301.477514-1-tmshlvck@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: stmmac: dwmac-renesas-gbeth: Add support for RZ/G3L SoCBiju Das
Compared to other Renesas GBETH stmmac glue drivers, RZ/G3L GBETH IP use the version Synopsys DesignWare MAC (version 5.30). It has an extra clock compared to RZ/V2H and has ptp_pps_o interrupts. Add support for RZ/G3L GBETH by reusing device data of RZ/V2H and can be extended to add other functionalities later. Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/20260131161250.5047-3-biju.das.jz@bp.renesas.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02Merge branch '100GbE' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-01-30 (ice, i40e) This series contains updates to ice and i40e drivers. Grzegorz and Jake resolve issues around timing for E825 that can cause Tx timestamps to be missed/interrupts not generated on ice. Aaron Ma defers restart of PTP work until after after VSIs are rebuilt to prevent NULL pointer dereference for ice. Mohammad Heib removes calls to udp_tunnel_get_rx_info() in ice and i40e which violates locking expectations and is unneeded. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: i40e: drop udp_tunnel_get_rx_info() call from i40e_open() ice: drop udp_tunnel_get_rx_info() call from ndo_open() ice: Fix PTP NULL pointer dereference during VSI rebuild ice: PTP: fix missing timestamps on E825 hardware ice: fix missing TX timestamps interrupts on E825 devices ==================== Link: https://patch.msgid.link/20260130185401.1091523-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: enetc: Convert 16-bit register reads to 32-bit for ENETC v4Claudiu Manoil
It is not recommended to access the 32‑bit registers of this hardware IP using lower‑width accessors (i.e. 16‑bit), and the only exception to this rule was introduced in the initial ENETC v1 driver for the PMAR1 register, which holds the lower 16 bits of the primary MAC address of an SI. Meanwhile, this exception has been replicated in the v4 driver code as well. Since LS1028 (the only SoC with ENETC v1) is not affected by this issue, the current patch converts the 16‑bit reads from PMAR1 starting with ENETC v4. Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF") Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com> Reviewed-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260130141035.272471-5-claudiu.manoil@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: enetc: Convert 16-bit register writes to 32-bit for ENETC v4Claudiu Manoil
For ENETC v4, which is integrated into more complex SoCs (compared to v1), 16‑bit register writes are blocked in the SoC interconnect on some chips. To be fair, it is not recommended to access 32‑bit registers of this IP using lower‑width accessors (i.e. 16‑bit), and the only exception to this rule was introduced by me in the initial ENETC v1 driver for the PMAR1 register, which holds the lower 16 bits of the primary MAC address of an SI. Meanwhile, this exception has been replicated for v4 as well. Since LS1028 (the only SoC with ENETC v1) is not affected by this issue, the current patch fixes the 16‑bit writes to PMAR1 starting with ENETC v4. Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF") Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com> Reviewed-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260130141035.272471-4-claudiu.manoil@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: enetc: Remove CBDR cacheability AXI settings for ENETC v4Claudiu Manoil
For ENETC v4 these settings are controlled by the global ENETC command cache attribute registers (EnCAR), from the IERB register block. The hardcoded CDBR cacheability settings were inherited from LS1028A, and should be removed from the ENETC v4 driver as they conflict with the global IERB settings. Fixes: e3f4a0a8ddb4 ("net: enetc: add command BD ring support for i.MX95 ENETC") Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com> Reviewed-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260130141035.272471-3-claudiu.manoil@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: enetc: Remove SI/BDR cacheability AXI settings for ENETC v4Claudiu Manoil
For ENETC v4 these settings are controlled by the global ENETC message and buffer cache attribute registers (EnBCAR and EnMCAR), from the IERB register block. The hardcoded cacheability settings were inherited from LS1028A, and should be removed from the ENETC v4 driver as they conflict with the global IERB settings. Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF") Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com> Reviewed-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260130141035.272471-2-claudiu.manoil@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02ptp: ptp_vmclock: return TAI not UTCDavid Woodhouse
To output UTC would involve complex calculations about whether the time elapsed since the reference time has crossed the end of the month when a leap second takes effect. I've prototyped that, but it made me sad. Much better to report TAI, which is what PHCs should do anyway. And much much simpler. Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Signed-off-by: Babis Chalios <bchalios@amazon.es> Tested-by: Takahiro Itazuri <itazur@amazon.com> Link: https://patch.msgid.link/20260130173704.12575-8-itazur@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02ptp: ptp_vmclock: remove dependency on CONFIG_ACPIDavid Woodhouse
Now that we added device tree support we can remove dependency on CONFIG_ACPI. Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Signed-off-by: Babis Chalios <bchalios@amazon.es> Tested-by: Takahiro Itazuri <itazur@amazon.dom> Link: https://patch.msgid.link/20260130173704.12575-7-itazur@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02ptp: ptp_vmclock: add 'VMCLOCK' to ACPI device matchDavid Woodhouse
As we finalised the spec, we spotted that vmgenid actually says that the _HID is supposed to be hypervisor-specific. Although in the 13 years since the original vmgenid doc was published, nobody seems to have cared about using _HID to distinguish between implementations on different hypervisors, and we only ever use the _CID. For consistency, match the _CID of "VMCLOCK" too. Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Signed-off-by: Babis Chalios <bchalios@amazon.es> Tested-by: Takahiro Itazuri <itazur@amazon.com> Link: https://patch.msgid.link/20260130173704.12575-6-itazur@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02ptp: ptp_vmclock: Add device tree supportDavid Woodhouse
Add device tree support to the ptp_vmclock driver, allowing it to probe via device tree in addition to ACPI. Handle optional interrupt for clock disruption notifications, mirroring the ACPI notification behaviour. Although the interrupt is marked as 'optional' in the DT bindings, if the device *advertises* the VMCLOCK_FLAG_NOTIFICATION_ABSENT then it *should* have an interrupt. The driver will refuse to initialize if not. Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Signed-off-by: Babis Chalios <bchalios@amazon.es> Signed-off-by: Takahiro Itazuri <itazur@amazon.com> Tested-by: Takahiro Itazuri <itazur@amazon.com> Link: https://patch.msgid.link/20260130173704.12575-5-itazur@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02ptp: vmclock: support device notificationsBabis Chalios
Add optional support for device notifications in VMClock. When supported, the hypervisor will send a device notification every time it updates the seq_count to a new even value. Moreover, add support for poll() in VMClock as a means to propagate this notification to user space. poll() will return a POLLIN event to listeners every time seq_count changes to a value different than the one last seen (since open() or last read()/pread()). This means that when poll() returns a POLLIN event, listeners need to use read() to observe what has changed and update the reader's view of seq_count. In other words, after a poll() returned, all subsequent calls to poll() will immediately return with a POLLIN event until the listener calls read(). The device advertises support for the notification mechanism by setting flag VMCLOCK_FLAG_NOTIFICATION_PRESENT in vmclock_abi flags field. If the flag is not present the driver won't setup the ACPI notification handler and poll() will always immediately return POLLHUP. Signed-off-by: Babis Chalios <bchalios@amazon.es> Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Signed-off-by: Takahiro Itazuri <itazur@amazon.com> Reviewed-by: David Woodhouse <dwmw@amazon.co.uk> Tested-by: Takahiro Itazuri <itazur@amazon.com> Link: https://patch.msgid.link/20260130173704.12575-3-itazur@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: remove unnecessary module_init/exit functionsEthan Nelson-Moore
Many network drivers have unnecessary empty module_init and module_exit functions. Remove them (including some that just print a message). Note that if a module_init function exists, a module_exit function must also exist; otherwise, the module cannot be unloaded. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Acked-by: Marc Kleine-Budde <mkl@pengutronix.de> Acked-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Link: https://patch.msgid.link/20260131004327.18112-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: ethernet: use module_pci_driver; remove useless driver versionsEthan Nelson-Moore
The module version is useless, and the only thing these drivers' init routines did besides pci_register_driver was to print the driver name and/or version. Acked-by: Francois Romieu <romieu@fr.zoreil.com> (epic100) Reviewed-by: Simon Horman <horms@kernel.org> (epic100, sis900) Reviewed-by: Sai Krishna <saikrishnag@marvell.com> (epic100) Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Link: https://patch.msgid.link/20260131022441.56274-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: phy: dp83867: Always program R/SGMII enable bitsSean Anderson
If the board designers have neglected to populate the appropriate resistors on the strapping pins then the phy may default to the wrong interface mode. Enable/disable the RGMII/SGMII enable bits as necessary to select the correct interface. The dp83867 strapping pins have four levels and typically configure two features at once. LED_0 controls both port mirroring and whether SGMII is enabled. If it is pulled to VDDIO, both port mirroring and SGMII will be enabled. For variants of the dp83867 that do not support SGMII, this will prevent data from being transferred. As we now explicitly set the SGMII and RGMII enable bits, we do not need to detect whether SGMII has been inadvertently enabled. Signed-off-by: Sean Anderson <sean.anderson@linux.dev> Link: https://patch.msgid.link/20260129171205.3868605-3-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: phy: dp83867: Program TX FIFO for all interfacesSean Anderson
All supported interfaces use the TX FIFO register at least some of the time, so there's no point in checking the interface. Retain the check for the RX FIFO level since it is only used by SGMII. Signed-off-by: Sean Anderson <sean.anderson@linux.dev> Link: https://patch.msgid.link/20260129171205.3868605-2-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: stmmac: fix stm32 (and potentially others) resume regressionRussell King (Oracle)
Marek reported that suspending stm32 causes the following errors when the interface is administratively down: $ echo devices > /sys/power/pm_test $ echo mem > /sys/power/state ... ck_ker_eth2stp already disabled ... ck_ker_eth2stp already unprepared ... On suspend, stm32 starts the eth2stp clock in its suspend method, and stops it in the resume method. This is because the blamed commit omits the call to the platform glue ->suspend() method, but does make the call to the platform glue ->resume() method. This problem affects all other converted drivers as well - e.g. looking at the PCIe drivers, pci_save_state() will not be called, but pci_restore_state() will be. Similar issues affect all other drivers. Fix this by always calling the ->suspend() method, even when the network interface is down. This fixes all the conversions to the platform glue ->suspend() and ->resume() methods. Link: https://lore.kernel.org/r/20260114081809.12758-1-marex@nabladev.com Fixes: 07bbbfe7addf ("net: stmmac: add suspend()/resume() platform ops") Reported-by: Marek Vasut <marex@nabladev.com> Tested-by: Marek Vasut <marex@nabladev.com> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1vlujh-00000007Hkw-2p6r@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02bnxt_en: Allow ntuple filters for dropsJoe Damato
It appears that in commit 7efd79c0e689 ("bnxt_en: Add drop action support for ntuple"), bnxt gained support for ntuple filters for packet drops. However, support for this does not seem to work in recent kernels or against net-next: % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1 rmgr: Cannot insert RX class rule: Operation not supported Cannot insert classification rule The issue is that the existing code uses ethtool_get_flow_spec_ring_vf, which will return a non-zero value if the ring_cookie is set to RX_CLS_FLOW_DISC, which then causes bnxt_add_ntuple_cls_rule to return -EOPNOTSUPP because it thinks the user is trying to set an ntuple filter for a vf. Fix this by first checking that the ring_cookie is not RX_CLS_FLOW_DISC. After this patch, ntuple filters for drops can be added: % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1 Added rule with ID 0 % ethtool -n eth0 44 RX rings available Total 1 rules Filter: 0 Rule Type: UDP over IPv4 Src IP addr: 1.1.1.1 mask: 0.0.0.0 Dest IP addr: 0.0.0.0 mask: 255.255.255.255 TOS: 0x0 mask: 0xff Src port: 0 mask: 0xffff Dest port: 0 mask: 0xffff Action: Drop Reviewed-by: Michael Chan <michael.chan@broadcom.com> Signed-off-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/20260131003042.2570434-1-joe@dama.to Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: spacemit: display phy driver informationChukun Pan
Print the PHY driver used and interrupt status after connection. Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260201100001.33102-1-amadeus@jmu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02clk: Disable KUNIT_UML_PCIPeng Fan
commit 031cdd3bc3f3 ("kunit: Enable PCI on UML without triggering WARN()") enables KUNIT_UML_PCI, but clk driver could not work with it. Deselect KUNIT_UML_PCI to avoid the failure. Dump as below: WARNING: CPU: 0 PID: 227 at lib/logic_iomem.c:141 __raw_readl+0xac/0xe0 CPU: 0 UID: 0 PID: 227 Comm: kunit_try_catch Tainted: G Tainted: [N]=TEST Stack: a0883d00 00000001 00000000 ffffff00 603ef142 60044832 6002598b 00000000 00000000 600211b3 00000001 00000000 Call Trace: [<6032534c>] ? __raw_readl+0xac/0xe0 [<60044832>] ? dump_stack_lvl+0x57/0x73 [<6002598b>] ? _printk+0x0/0x61 [<600211b3>] ? __warn.cold+0x61/0xeb [<600212cc>] ? warn_slowpath_fmt+0x8f/0x9c [<6002123d>] ? warn_slowpath_fmt+0x0/0x9c [<6032534c>] ? __raw_readl+0xac/0xe0 [<6002123d>] ? warn_slowpath_fmt+0x0/0x9c [<6029e2ad>] ? clk_gate_endisable+0xcd/0x110 [<6029e315>] ? clk_gate_enable+0x15/0x20 [<6028795e>] ? clk_core_enable+0x6e/0xf0 [<60289f1f>] ? clk_enable+0x4f/0xa0 [<602a06af>] ? clk_gate_test_enable+0xbf/0x360 [<60053df9>] ? os_nsecs+0x29/0x40 [<600cd300>] ? ktime_get_ts64+0x0/0x130 [<600816c0>] ? to_kthread+0x0/0x50 [<602507bb>] ? kunit_try_run_case+0x7b/0x100 [<600816c0>] ? to_kthread+0x0/0x50 [<60252aa0>] ? kunit_generic_run_threadfn_adapter+0x0/0x30 [<60252ab2>] ? kunit_generic_run_threadfn_adapter+0x12/0x30 [<60082091>] ? kthread+0xf1/0x270 [<60047591>] ? new_thread_handler+0x41/0x60 ---[ end trace 0000000000000000 ]--- Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-02-03tpm: st33zp24: Fix missing cleanup on get_burstcount() errorAlper Ak
get_burstcount() can return -EBUSY on timeout. When this happens, st33zp24_send() returns directly without releasing the locality acquired earlier. Use goto out_err to ensure proper cleanup when get_burstcount() fails. Fixes: bf38b8710892 ("tpm/tpm_i2c_stm_st33: Split tpm_i2c_tpm_st33 in 2 layers (core + phy)") Signed-off-by: Alper Ak <alperyasinak1@gmail.com> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-02-03tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failureAlper Ak
get_burstcount() can return -EBUSY on timeout. When this happens, the function returns directly without releasing the locality that was acquired at the beginning of tpm_tis_i2c_send(). Use goto out_err to ensure proper cleanup when get_burstcount() fails. Fixes: aad628c1d91a ("char/tpm: Add new driver for Infineon I2C TIS TPM") Signed-off-by: Alper Ak <alperyasinak1@gmail.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-02-02clk: rs9: Convert to DEFINE_SIMPLE_DEV_PM_OPS()Geert Uytterhoeven
Convert the Renesas 9-series PCIe clock generator driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the __maybe_unused annotations from its suspend and resume callbacks, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-02-02clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841Marek Vasut
The 9FGV0841 has 8 outputs and registers 8 struct clk_hw, make sure there are 8 slots for those newly registered clk_hw pointers, else there is going to be out of bounds write when pointers 4..7 are set into struct rs9_driver_data .clk_dif[4..7] field. Since there are other structure members past this struct clk_hw pointer array, writing to .clk_dif[4..7] fields corrupts both the struct rs9_driver_data content and data around it, sometimes without crashing the kernel. However, the kernel does surely crash when the driver is unbound or during suspend. Fix this, increase the struct clk_hw pointer array size to the maximum output count of 9FGV0841, which is the biggest chip that is supported by this driver. Cc: stable@vger.kernel.org Fixes: f0e5e1800204 ("clk: rs9: Add support for 9FGV0841") Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Reported-by: Geert Uytterhoeven <geert+renesas@glider.be> Closes: https://lore.kernel.org/CAMuHMdVyQpOBT+Ho+mXY07fndFN9bKJdaaWGn91WOFnnYErLyg@mail.gmail.com Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-02-03pinctrl: mediatek: remove unused drv_offset fieldAkari Tsuyukusa
The 'drv_offset' member in 'struct mtk_pinctrl_devdata' has been unused since the driver's inception. Drive strength control for MediaTek pinctrl drivers is actually configured via 'pin_drv_grp', making this specific offset field redundant. Remove the unused field from the common 'mtk_pinctrl_devdata' structure and its corresponding initialization in the mt8365 driver to clean up the code and avoid confusion. Signed-off-by: Akari Tsuyukusa <akkun11.open@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-02-03pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetreeJiayu Du
When probing the k230 pinctrl driver, the kernel triggers a NULL pointer dereference. The crash trace showed: [ 0.732084] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068 [ 0.740737] ... [ 0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc In k230_pinctrl_parse_functions(), we attempt to retrieve the device pointer via info->pctl_dev->dev, but info->pctl_dev is only initialized after k230_pinctrl_parse_dt() completes. At the time of DT parsing, info->pctl_dev is still NULL, leading to the invalid dereference of info->pctl_dev->dev. Use the already available device pointer from platform_device instead of accessing through uninitialized pctl_dev. Fixes: d94a32ac688f ("pinctrl: canaan: k230: Fix order of DT parse and pinctrl register") Signed-off-by: Jiayu Du <jiayu.riscv@isrc.iscas.ac.cn> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-02-03pinctrl: single: fix refcount leak in pcs_add_gpio_func()Wei Li
of_parse_phandle_with_args() returns a device_node pointer with refcount incremented in gpiospec.np. The loop iterates through all phandles but never releases the reference, causing a refcount leak on each iteration. Add of_node_put() calls to release the reference after extracting the needed arguments and on the error path when devm_kzalloc() fails. This bug was detected by our static analysis tool and verified by my code review. Fixes: a1a277eb76b3 ("pinctrl: single: create new gpio function range") Signed-off-by: Wei Li <unsw.weili@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-02-03pinctrl: meson: amlogic-a4: Fix device node reference leak in bank helpersFelix Gu
of_parse_phandle_with_fixed_args() increments the reference count of the returned device node, so it must be explicitly released using of_node_put() after use. Fix the reference leak in aml_bank_pins() and aml_bank_number() by adding the missing of_node_put() calls. Fixes: 6e9be3abb78c ("pinctrl: Add driver support for Amlogic SoCs") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Reviewed-by: Xianwei Zhao <xianwei.zhao@amlogic.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-02-03pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definitionLuca Weiss
The i2s2_data function is available on both gpio12 and gpio13. Fix the groups definition. Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver") Signed-off-by: Luca Weiss <luca.weiss@fairphone.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-11 10:37:58 +0000