summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-07-21Merge branch '200GbE' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-07-18 (idpf, ice, igc, igbvf, ixgbevf) For idpf: Ahmed and Sudheer add support for flow steering via ntuple filters. Current support is for IPv4 and TCP/UDP only. Milena adds support for cross timestamping. Ahmed preserves coalesce settings across resets. For ice: Alex adds reporting of 40GbE speed in devlink port split. Dawid adds support for E835 devices. Jesse refactors profile ptype processing for cleaner, more readable, code. Dave adds a couple of helper functions for LAG to reduce code duplication. For igc: Siang adds support to configure "Default Queue" during runtime using ethtool's Network Flow Classification (NFC) wildcard rule approach. For igbvf: Yuto Ohnuki removes unused fields from igbvf_adapter. For ixgbevf: Yuto Ohnuki removes unused fields from ixgbevf_adapter. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ixgbevf: remove unused fields from struct ixgbevf_adapter igbvf: remove unused fields from struct igbvf_adapter igc: Add wildcard rule support to ethtool NFC using Default Queue igc: Relocate RSS field definitions to igc_defines.h ice: breakout common LAG code into helpers ice: convert ice_add_prof() to bitmap ice: add E835 device IDs ice: add 40G speed to Admin Command GET PORT OPTION idpf: preserve coalescing settings across resets idpf: add cross timestamping idpf: add flow steering support virtchnl2: add flow steering support virtchnl2: rename enum virtchnl2_cap_rss ==================== Link: https://patch.msgid.link/20250718185118.2042772-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-07-21gve: Fix stuck TX queue for DQ queue formatPraveen Kaligineedi
gve_tx_timeout was calculating missed completions in a way that is only relevant in the GQ queue format. Additionally, it was attempting to disable device interrupts, which is not needed in either GQ or DQ queue formats. As a result, TX timeouts with the DQ queue format likely would have triggered early resets without kicking the queue at all. This patch drops the check for pending work altogether and always kicks the queue after validating the queue has not seen a TX timeout too recently. Cc: stable@vger.kernel.org Fixes: 87a7f321bb6a ("gve: Recover from queue stall due to missed IRQ") Co-developed-by: Tim Hostetler <thostet@google.com> Signed-off-by: Tim Hostetler <thostet@google.com> Signed-off-by: Praveen Kaligineedi <pkaligineedi@google.com> Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com> Link: https://patch.msgid.link/20250717192024.1820931-1-hramamurthy@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-07-21net: usb: cdc-ncm: check for filtering capabilityOliver Neukum
If the decice does not support filtering, filtering must not be used and all packets delivered for the upper layers to sort. Signed-off-by: Oliver Neukum <oneukum@suse.com> Link: https://patch.msgid.link/20250717120649.2090929-1-oneukum@suse.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-07-21net: stmmac: dwmac-renesas-gbeth: Add PM suspend/resume callbacksBiju Das
Add PM suspend/resume callbacks for RZ/G3E SMARC EVK. The PM deep entry is executed by pressing the SLEEP button and exit from entry is by pressing the power button. Logs: root@smarc-rzg3e:~# PM: suspend entry (deep) Filesystems sync: 0.115 seconds Freezing user space processes Freezing user space processes completed (elapsed 0.002 seconds) OOM killer disabled. Freezing remaining freezable tasks Freezing remaining freezable tasks completed (elapsed 0.001 seconds) printk: Suspending console(s) (use no_console_suspend to debug) NOTICE: BL2: v2.10.5(release):2.10.5/rz_soc_dev-162-g7148ba838 NOTICE: BL2: Built : 14:23:58, Jul 5 2025 NOTICE: BL2: SYS_LSI_MODE: 0x13e06 NOTICE: BL2: SYS_LSI_DEVID: 0x8679447 NOTICE: BL2: SYS_LSI_PRR: 0x0 NOTICE: BL2: Booting BL31 renesas-gbeth 15c30000.ethernet end0: Link is Down Disabling non-boot CPUs ... psci: CPU3 killed (polled 0 ms) psci: CPU2 killed (polled 0 ms) psci: CPU1 killed (polled 0 ms) Enabling non-boot CPUs ... Detected VIPT I-cache on CPU1 GICv3: CPU1: found redistributor 100 region 0:0x0000000014960000 CPU1: Booted secondary processor 0x0000000100 [0x412fd050] CPU1 is up Detected VIPT I-cache on CPU2 GICv3: CPU2: found redistributor 200 region 0:0x0000000014980000 CPU2: Booted secondary processor 0x0000000200 [0x412fd050] CPU2 is up Detected VIPT I-cache on CPU3 GICv3: CPU3: found redistributor 300 region 0:0x00000000149a0000 CPU3: Booted secondary processor 0x0000000300 [0x412fd050] CPU3 is up dwmac4: Master AXI performs fixed burst length 15c30000.ethernet end0: No Safety Features support found 15c30000.ethernet end0: IEEE 1588-2008 Advanced Timestamp supported 15c30000.ethernet end0: configuring for phy/rgmii-id link mode dwmac4: Master AXI performs fixed burst length 15c40000.ethernet end1: No Safety Features support found 15c40000.ethernet end1: IEEE 1588-2008 Advanced Timestamp supported 15c40000.ethernet end1: configuring for phy/rgmii-id link mode OOM killer enabled. Restarting tasks: Starting Restarting tasks: Done random: crng reseeded on system resumption PM: suspend exit 15c30000.ethernet end0: Link is Up - 1Gbps/Full - flow control rx/tx root@smarc-rzg3e:~# ifconfig end0 192.168.10.7 up root@smarc-rzg3e:~# ping 192.168.10.1 PING 192.168.10.1 (192.168.10.1) 56(84) bytes of data. 64 bytes from 192.168.10.1: icmp_seq=1 ttl=64 time=2.05 ms 64 bytes from 192.168.10.1: icmp_seq=2 ttl=64 time=0.928 ms Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250717071109.8213-1-biju.das.jz@bp.renesas.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-07-21net: bcmasp: Restore programming of TX map vector registerFlorian Fainelli
On ASP versions v2.x we need to program the TX map vector register to properly exercise end-to-end flow control, otherwise the TX engine can either lock-up, or cause the hardware calculated checksum to be wrong/corrupted when multiple back to back packets are being submitted for transmission. This register defaults to 0, which means no flow control being applied. Fixes: e9f31435ee7d ("net: bcmasp: Add support for asp-v3.0") Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com> Link: https://patch.msgid.link/20250718212242.3447751-1-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-07-21amd-xgbe: add hardware PTP timestamping supportRaju Rangoju
Adds complete support for hardware-based PTP (IEEE 1588) timestamping to the AMD XGBE driver. - Initialize and configure the MAC PTP registers based on link speed and reference clock. - Support both 50MHz and 125MHz PTP reference clocks. - Update the driver interface and version data to support PTP clock frequency selection. Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com> Link: https://patch.msgid.link/20250718185628.4038779-3-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-07-21and-xgbe: remove the abstraction for hwptpRaju Rangoju
Remove the hwptp abstraction and associated callbacks from the struct xgbe_hw_if {}. The callback structure was only ever assigned a single function, without null checks. This cleanup inlines the logic and moves all the hwtstamp realted code a separate file, improving readability and maintainance. Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com> Link: https://patch.msgid.link/20250718185628.4038779-2-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-07-21wifi: ath12k: Correct tid cleanup when tid setup failsSarika Sharma
Currently, if any error occurs during ath12k_dp_rx_peer_tid_setup(), the tid value is already incremented, even though the corresponding TID is not actually allocated. Proceed to ath12k_dp_rx_peer_tid_delete() starting from unallocated tid, which might leads to freeing unallocated TID and cause potential crash or out-of-bounds access. Hence, fix by correctly decrementing tid before cleanup to match only the successfully allocated TIDs. Also, remove tid-- from failure case of ath12k_dp_rx_peer_frag_setup(), as decrementing the tid before cleanup in loop will take care of this. Compile tested only. Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20250721061749.886732-1-quic_sarishar@quicinc.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-07-21wifi: ath12k: bring DFS support back for WCN7850Baochen Qiang
Due to the restrict in MAC80211 that DFS (Dynamic Frequency Selection) can't be enabled on multiple channels, commit 176f3009ae59 ("wifi: ath12k: support 2 channels for single pdev device") removes DFS support in order to support 2 channels concurrently, making AP mode not working on DFS channels [1]. Revert portions of that commit to bring DFS back, and add a new combination to support 2-channels concurrency. This is valid because the MAC80211 restrict works on each individual combination, but does not care about them as a whole, as far as DFS is concerned. This change applies to WCN7850 only, other chips are not affected. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: 176f3009ae59 ("wifi: ath12k: support 2 channels for single pdev device") Reported-by: Mihai Moldovan <ionic@ionic.de> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220346 # 1 Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Tested-by: Mihai Moldovan <ionic@ionic.de> Link: https://patch.msgid.link/20250721-ath12k-dfs-v1-1-065c31454f91@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-07-21wifi: ath12k: Prefer {} to {0} in initializersJeff Johnson
Prefer {} to {0} in initializers since {} works even when the first member is not a scalar. Generated using: sed -i 's/{[[:space:]]*0[[:space:]]*}/{}/g' drivers/net/wireless/ath/ath12k/* Compile tested only. Link: https://patch.msgid.link/20250720-ath12k-zero-brace-v1-1-d8c8ca9d40a8@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-07-21wifi: ath11k: Prefer {} to {0} in initializersJeff Johnson
Prefer {} to {0} in initializers since {} works even when the first member is not a scalar. Generated using: sed -i 's/{[[:space:]]*0[[:space:]]*}/{}/g' drivers/net/wireless/ath/ath11k/* Compile tested only. Link: https://patch.msgid.link/20250720-ath11k-zero-brace-v1-1-6132e2ef1748@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-07-21wifi: ath10k: Prefer {} to {0} in initializersJeff Johnson
Prefer {} to {0} in initializers since {} works even when the first member is not a scalar. Generated using: sed -i 's/{[[:space:]]*0[[:space:]]*}/{}/g' drivers/net/wireless/ath/ath10k/* Compile tested only. Link: https://patch.msgid.link/20250720-ath10k-zero-brace-v1-1-c1ee818d6238@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-07-21PM: cpufreq: powernv/tracing: Move powernv_throttle trace eventSteven Rostedt
As the trace event powernv_throttle is only used by the powernv code, move it to a separate include file and have that code directly enable it. Trace events can take up around 5K of memory when they are defined regardless if they are used or not. It wastes memory to have them defined in configurations where the tracepoint is not used. Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/20250612145407.906308844@goodmis.org Fixes: 0306e481d479a ("cpufreq: powernv/tracing: Add powernv_throttle tracepoint") Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Acked-by: Rafael J. Wysocki <rafael@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2025-07-21wifi: brcmfmac: support CYW54591 PCIE deviceDouble Lo
CYW54591 is a variant of BCM4355 silicon with the same chipid. In the chipid-fwname mapping table, apply chiprev 13 to identify CYW54591. Skip reading OTP process for CYW chip since it contains vendor specific information which is not common for cypress. Signed-off-by: Double Lo <double.lo@cypress.com> Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com> Signed-off-by: Ian Lin <ian.lin@infineon.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20250624093453.7264-1-ian.lin@infineon.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-07-21wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IEGokul Sivakumar
After commit bd99a3013bdc ("brcmfmac: move configuration of probe request IEs"), the probe request MGMT IE addition operation brcmf_vif_set_mgmt_ie() got moved from the brcmf_p2p_scan_prep() to the brcmf_cfg80211_scan(). Because of this, as part of the scan request handler for the P2P Discovery, vif struct used for adding the Probe Request P2P IE in firmware got changed from the P2PAPI_BSSCFG_DEVICE vif to P2PAPI_BSSCFG_PRIMARY vif incorrectly. So the firmware stopped adding P2P IE to the outgoing P2P Discovery probe requests frames and the other P2P peers were unable to discover this device causing a regression on the P2P feature. To fix this, while setting the P2P IE in firmware, properly use the vif of the P2P discovery wdev on which the driver received the P2P scan request. This is done by not changing the vif pointer, until brcmf_vif_set_mgmt_ie() is completed. Fixes: bd99a3013bdc ("brcmfmac: move configuration of probe request IEs") Signed-off-by: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20250626050706.7271-1-gokulkumar.sivakumar@infineon.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-07-21e1000e: ignore uninitialized checksum word on tgpJacek Kowalski
As described by Vitaly Lifshits: > Starting from Tiger Lake, LAN NVM is locked for writes by SW, so the > driver cannot perform checksum validation and correction. This means > that all NVM images must leave the factory with correct checksum and > checksum valid bit set. Unfortunately some systems have left the factory with an uninitialized value of 0xFFFF at register address 0x3F (checksum word location). So on Tiger Lake platform we ignore the computed checksum when such condition is encountered. Signed-off-by: Jacek Kowalski <jacek@jacekk.info> Tested-by: Vlad URSU <vlad@ursu.me> Fixes: 4051f68318ca9 ("e1000e: Do not take care about recovery NVM checksum") Cc: stable@vger.kernel.org Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Vitaly Lifshits <vitaly.lifshits@intel.com> Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2025-07-21e1000e: disregard NVM checksum on tgp when valid checksum bit is not setJacek Kowalski
As described by Vitaly Lifshits: > Starting from Tiger Lake, LAN NVM is locked for writes by SW, so the > driver cannot perform checksum validation and correction. This means > that all NVM images must leave the factory with correct checksum and > checksum valid bit set. Since Tiger Lake devices were the first to have > this lock, some systems in the field did not meet this requirement. > Therefore, for these transitional devices we skip checksum update and > verification, if the valid bit is not set. Signed-off-by: Jacek Kowalski <jacek@jacekk.info> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Vitaly Lifshits <vitaly.lifshits@intel.com> Fixes: 4051f68318ca9 ("e1000e: Do not take care about recovery NVM checksum") Cc: stable@vger.kernel.org Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2025-07-21ice: Fix a null pointer dereference in ice_copy_and_init_pkg()Haoxiang Li
Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference. Fixes: c76488109616 ("ice: Implement Dynamic Device Personalization (DDP) download") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com> Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2025-07-21i40e: When removing VF MAC filters, only check PF-set MACJamie Bainbridge
When the PF is processing an Admin Queue message to delete a VF's MACs from the MAC filter, we currently check if the PF set the MAC and if the VF is trusted. This results in undesirable behaviour, where if a trusted VF with a PF-set MAC sets itself down (which sends an AQ message to delete the VF's MAC filters) then the VF MAC is erased from the interface. This results in the VF losing its PF-set MAC which should not happen. There is no need to check for trust at all, because an untrusted VF cannot change its own MAC. The only check needed is whether the PF set the MAC. If the PF set the MAC, then don't erase the MAC on link-down. Resolve this by changing the deletion check only for PF-set MAC. (the out-of-tree driver has also intentionally removed the check for VF trust here with OOT driver version 2.26.8, this changes the Linux kernel driver behaviour and comment to match the OOT driver behaviour) Fixes: ea2a1cfc3b201 ("i40e: Fix VF MAC filter removal") Signed-off-by: Jamie Bainbridge <jamie.bainbridge@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Rafal Romanowski <rafal.romanowski@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2025-07-21i40e: report VF tx_dropped with tx_errors instead of tx_discardsDennis Chen
Currently the tx_dropped field in VF stats is not updated correctly when reading stats from the PF. This is because it reads from i40e_eth_stats.tx_discards which seems to be unused for per VSI stats, as it is not updated by i40e_update_eth_stats() and the corresponding register, GLV_TDPC, is not implemented[1]. Use i40e_eth_stats.tx_errors instead, which is actually updated by i40e_update_eth_stats() by reading from GLV_TEPC. To test, create a VF and try to send bad packets through it: $ echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs $ cat test.py from scapy.all import * vlan_pkt = Ether(dst="ff:ff:ff:ff:ff:ff") / Dot1Q(vlan=999) / IP(dst="192.168.0.1") / ICMP() ttl_pkt = IP(dst="8.8.8.8", ttl=0) / ICMP() print("Send packet with bad VLAN tag") sendp(vlan_pkt, iface="enp2s0f0v0") print("Send packet with TTL=0") sendp(ttl_pkt, iface="enp2s0f0v0") $ ip -s link show dev enp2s0f0 16: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 link/ether 3c:ec:ef:b7:e0:ac brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped missed mcast 0 0 0 0 0 0 TX: bytes packets errors dropped carrier collsns 0 0 0 0 0 0 vf 0 link/ether e2:c6:fd:c1:1e:92 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off RX: bytes packets mcast bcast dropped 0 0 0 0 0 TX: bytes packets dropped 0 0 0 $ python test.py Send packet with bad VLAN tag . Sent 1 packets. Send packet with TTL=0 . Sent 1 packets. $ ip -s link show dev enp2s0f0 16: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 link/ether 3c:ec:ef:b7:e0:ac brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped missed mcast 0 0 0 0 0 0 TX: bytes packets errors dropped carrier collsns 0 0 0 0 0 0 vf 0 link/ether e2:c6:fd:c1:1e:92 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off RX: bytes packets mcast bcast dropped 0 0 0 0 0 TX: bytes packets dropped 0 0 0 A packet with non-existent VLAN tag and a packet with TTL = 0 are sent, but tx_dropped is not incremented. After patch: $ ip -s link show dev enp2s0f0 19: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 link/ether 3c:ec:ef:b7:e0:ac brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped missed mcast 0 0 0 0 0 0 TX: bytes packets errors dropped carrier collsns 0 0 0 0 0 0 vf 0 link/ether 4a:b7:3d:37:f7:56 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off RX: bytes packets mcast bcast dropped 0 0 0 0 0 TX: bytes packets dropped 0 0 2 Fixes: dc645daef9af5bcbd9c ("i40e: implement VF stats NDO") Signed-off-by: Dennis Chen <dechen@redhat.com> Link: https://www.intel.com/content/www/us/en/content-details/596333/intel-ethernet-controller-x710-tm4-at2-carlsville-datasheet.html Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Rafal Romanowski <rafal.romanowski@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2025-07-21Merge tag 'sunxi-clk-fixes-for-6.16' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-fixes Pull Allwinner clock fixes from Chen-Yu Tsai: - Mark A523 MBUS clock as critical - Fix names of CSI related clocks on V3s This includes changes to the driver, DT bindings and DT files. - Fix parents of TCON clock on V3s * tag 'sunxi-clk-fixes-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: v3s: Fix TCON clock parents clk: sunxi-ng: v3s: Fix CSI1 MCLK clock name clk: sunxi-ng: v3s: Fix CSI SCLK clock name clk: sunxi-ng: a523: Mark MBUS clock as critical
2025-07-21Merge tag 'tegra-for-6.17-soc' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers soc/tegra: Updates for v6.17-rc1 The bulk of this is the addition of Tegra264 support for various low- level components. This also adds fabric descriptors for the new Tegra254 and Tegra264 chips. * tag 'tegra-for-6.17-soc' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: soc/tegra: cbb: Add support for CBB fabrics in Tegra254 soc/tegra: cbb: Add support for CBB fabrics in Tegra264 soc/tegra: cbb: Support HW lookup to get timed out target address soc/tegra: cbb: Improve handling for per SoC fabric data soc/tegra: cbb: Make error interrupt enable and status per SoC soc/tegra: cbb: Change master/slave to initiator/target soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS soc/tegra: Add Tegra264 APBMISC compatible string soc/tegra: pmc: Add Tegra264 support soc/tegra: Enable support for Tegra264 Link: https://lore.kernel.org/r/20250711220943.2389322-1-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-07-21soc: fsl: qe: convert set_multiple() to returning an integerBartosz Golaszewski
The conversion to using the new GPIO line setter callbacks missed the set_multiple() in this file. Convert it to using the new callback. Fixes: 52ccf19527fd ("soc: fsl: qe: use new GPIO line value setter callbacks") Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-21pinctrl: rp1: use new GPIO line value setter callbacksBartosz Golaszewski
struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Andrea della Porta <andrea.porta@suse.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-07-21serial: 8250_ce4100: Fix CONFIG_SERIAL_8250=n buildAndy Shevchenko
On i386, when CONFIG_X86_INTEL_CE=y # CONFIG_SERIAL_8250 is not set it will try to compile the driver and use the stub simultaneously. This breaks the build. Fix it by making sure that the driver compiles only when CONFIG_SERIAL_8250 is also enabled. On top of that ensure that CONFIG_SERIAL_8250 is actually set to 'y' and not 'm' as the later makes no sense for this platform. The hook may only be applied during early boot. Fixes: acc902de05b2 ("serial: 8250: Move CE4100 quirks to a module under 8250 driver") Fixes: 5ec6960f6f0c ("ce4100: Add errata fixes for UART on CE4100") Reported-by: Randy Dunlap <rdunlap@infradead.org> Closes: https://lore.kernel.org/r/cdf4ee46-7bf8-4379-9245-fed9db72e7e8@infradead.org Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Tested-by: Randy Dunlap <rdunlap@infradead.org> Link: https://lore.kernel.org/r/20250716142412.1667927-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-21Merge tag 'platform-drivers-x86-v6.16-4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform drivers fixes from Ilpo Järvinen: - power supply code: - Add get/set property direct to allow avoiding taking psy->extensions_sem twice from power supply extensions - alienware-wmi-wmax: - Add AWCC support for Alienware Area-51m and m15 R5 - Fix `dmi_system_id` array termination - arm64: huawei-gaokun-ec: fix OF node leak - dell-ddv: Fix taking psy->extensions_sem twice - dell-lis3lv02d: Add Precision 3551 accelerometer support - firmware_attributes_class: Fix initialization order - ideapad-laptop: Retain FnLock and kbd backlight across boots - lenovo-wmi-hotkey: Avoid triggering error -5 due to missing mute LED - mellanox: mlxbf-pmc: Validate event names and bool input * tag 'platform-drivers-x86-v6.16-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: MAINTAINERS: Update entries for IFS and SBL drivers platform/x86: dell-lis3lv02d: Add Precision 3551 platform/x86: alieneware-wmi-wmax: Add AWCC support to more laptops platform/x86: Fix initialization order for firmware_attributes_class platform: arm64: huawei-gaokun-ec: fix OF node leak lenovo-wmi-hotkey: Avoid triggering error -5 due to missing mute LED platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots platform/x86: ideapad-laptop: Fix FnLock not remembered among boots platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input platform/mellanox: mlxbf-pmc: Validate event/enable input platform/mellanox: mlxbf-pmc: Remove newline char from event name input platform/x86: dell-ddv: Fix taking the psy->extensions_sem lock twice power: supply: test-power: Test access to extended power supply power: supply: core: Add power_supply_get/set_property_direct() platform/x86: alienware-wmi-wmax: Fix `dmi_system_id` array
2025-07-21Merge branch 'newsoc/cix-p1' into soc/newsocArnd Bergmann
Patches from Peter Chen <peter.chen@cixtech.com>: Cixtech P1 (internal name sky1) is high performance generic Armv9 SoC. Orion O6 is the Arm V9 Motherboard built by Radxa. You could find brief introduction for SoC and related boards at: https://radxa.com/products/orion/o6#overview Currently, to run upstream kernel at Orion O6 board, you need to use BIOS released by Radxa, and add "clk_ignore_unused=1" at bootargs. https://docs.radxa.com/en/orion/o6/bios/install-bios In this series, we add initial SoC and board support for Kernel building. Since mailbox is used for SCMI clock communication, mailbox driver is added in this series for the minimum SoC support. Patch 1-2: add dt-binding doc for CIX and its sky1 SoC Patch 3: add Arm64 build support Patch 4-5: add CIX mailbox driver which needs to support SCMI clock protocol. Patch 6: add Arm64 defconfig support Patch 7-8: add initial dts support for SoC and Orion O6 board Patch 9: add MAINTAINERS entry * newsoc/cix-p1: MAINTAINERS: Add CIX SoC maintainer entry arm64: dts: cix: Add sky1 base dts initial support dt-bindings: clock: cix: Add CIX sky1 scmi clock id arm64: defconfig: Enable CIX SoC mailbox: add CIX mailbox driver dt-bindings: mailbox: add cix,sky1-mbox arm64: Kconfig: add ARCH_CIX for cix silicons dt-bindings: arm: add CIX P1 (SKY1) SoC dt-bindings: vendor-prefixes: Add CIX Technology Group Co., Ltd. Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-07-21mailbox: add CIX mailbox driverGuomin Chen
The CIX mailbox controller, used in the Cix SoCs, like sky1. facilitates message transmission between multiple processors within the SoC, such as the AP, PM, audio DSP, SensorHub MCU, and others. Acked-by: Jassi Brar <jassisinghbrar@gmail.com> Reviewed-by: Peter Chen <peter.chen@cixtech.com> Signed-off-by: Guomin Chen <Guomin.Chen@cixtech.com> Signed-off-by: Gary Yang <gary.yang@cixtech.com> Signed-off-by: Lihua Liu <Lihua.Liu@cixtech.com> Signed-off-by: Peter Chen <peter.chen@cixtech.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-07-21Merge tag 'arm-soc/for-6.17/drivers' of https://github.com/Broadcom/stblinux ↵Arnd Bergmann
into soc/drivers This pull request contains Broadcom SoCs drivers updates for 6.17, please pull the following: - Andrea adds the RP1 clock, pinctrl/pinconf/gpio and misc driver to bind them all * tag 'arm-soc/for-6.17/drivers' of https://github.com/Broadcom/stblinux: pinctrl: rp1: Implement RaspberryPi RP1 pinmux/pinconf support misc: rp1: RaspberryPi RP1 misc driver pinctrl: rp1: Implement RaspberryPi RP1 gpio support clk: rp1: Add support for clocks provided by RP1 dt-bindings: clock: Add RaspberryPi RP1 clock bindings Link: https://lore.kernel.org/r/20250630190216.1518354-4-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-07-21Merge tag 'v6.16-rc7' into tty-nextGreg Kroah-Hartman
We need the tty/serial fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-21Merge tag 'mtk-soc-for-v6.17' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/drivers MediaTek soc driver updates for v6.17 This adds a single cleanup commit for the mtk-mutex driver, clarifying the usage of the MUTEX_MOD1, MUTEX_MOD2 registers for applying display controller sub-component mute settings on all MediaTek SoCs. * tag 'mtk-soc-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: soc: mediatek: mtk-mutex: Fix confusing usage of MUTEX_MOD2 Link: https://lore.kernel.org/r/20250711083656.33538-4-angelogioacchino.delregno@collabora.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-07-21Merge tag 'reset-for-v6.17' of https://git.pengutronix.de/git/pza/linux into ↵Arnd Bergmann
soc/drivers Reset controller updates for v6.17 * Support reset controllers on Kendryte K230 and SOPHGO CV1800B. * Add RZ/V2N USB2PHY reset controller bindings * Use auxiliary device creation helpers in reset-mpfs. * Convert nxp,lcp1850-rgu and snps,dw-reset binding docs to DT schema. * Enable reset-brcmstb(-rescal) on BCM2712. * Fix a typo in the T-HEAD TH1520 Kconfig option * tag 'reset-for-v6.17' of https://git.pengutronix.de/git/pza/linux: dt-bindings: reset: Convert snps,dw-reset to DT schema reset: brcmstb: Enable reset drivers for ARCH_BCM2835 reset: simple: add support for Sophgo CV1800B dt-bindings: reset: sophgo: Add CV1800B support reset: mpfs: use the auxiliary device creation dt-bindings: reset: renesas,rzv2h-usb2phy: Document RZ/V2N SoC support dt-bindings: reset: convert nxp,lpc1850-rgu.txt to yaml format reset: thead: Fix TH1520 typo reset: canaan: add reset driver for Kendryte K230 dt-bindings: reset: add support for canaan,k230-rst Link: https://lore.kernel.org/r/20250710152513.1346298-1-p.zabel@pengutronix.de Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-07-21ACPI: processor: throttling: Remove space before newlineColin Ian King
There is a extraneous space before a newline in a pr_warn message. Remove it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://patch.msgid.link/20250721135016.2500117-1-colin.i.king@gmail.com [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-07-21Merge tag 'soc_fsl-6.17-1' of https://github.com/chleroy/linux into soc/driversArnd Bergmann
FSL SOC Changes for 6.17: - Use dev_fwnode() instead of of_fwnode_handle() - Use new GPIO line value setter callbacks * tag 'soc_fsl-6.17-1' of https://github.com/chleroy/linux: soc: Use dev_fwnode() soc: fsl: qe: use new GPIO line value setter callbacks Link: https://lore.kernel.org/r/c947d537-cae5-44f0-abd8-0c558bac46d2@csgroup.eu Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-07-21Merge tag 'aspeed-6.17-drivers-1' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/drivers ASPEED SoC driver updates for 6.17 The ASPEED LPC snoop driver was recently the cause of some concern. In addition to the initial fixes, the channel configuration paths are refactored to improve robustness against errors. * tag 'aspeed-6.17-drivers-1' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: soc: aspeed: lpc-snoop: Lift channel config to const structs soc: aspeed: lpc-snoop: Consolidate channel initialisation soc: aspeed: lpc-snoop: Use dev_err_probe() where possible soc: aspeed: lpc-snoop: Switch to devm_clk_get_enabled() soc: aspeed: lpc-snoop: Rearrange channel paths soc: aspeed: lpc-snoop: Rename 'channel' to 'index' in channel paths soc: aspeed: lpc-snoop: Constrain parameters in channel paths soc: aspeed: lpc-snoop: Ensure model_data is valid soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled soc: aspeed: lpc-snoop: Cleanup resources in stack-order Link: https://lore.kernel.org/r/9123f151280e52c63dcb645cb07d4eee3462c067.camel@codeconstruct.com.au Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-07-21Merge tag 'renesas-drivers-for-v6.17-tag2' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers Renesas driver updates for v6.17 (take two) - Sort Renesas Kconfig symbols. * tag 'renesas-drivers-for-v6.17-tag2' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: soc: renesas: Sort Renesas Kconfig configs Link: https://lore.kernel.org/r/cover.1752090398.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-07-21Merge tag 'scmi-updates-6.17' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers Arm SCMI updates for v6.17 1. A fix is introduced to correct turbo frequency marking for 64-bit devices with sustained frequencies over 4GHz, ensuring accurate turbo frequency identification. 2. Debug capabilities are being improved by introducing in-flight transfer tracking using debug counters, which help diagnose transfer congestion and behavior. Additional tracepoints are added to log in-flight counts at transfer begin and end, offering better runtime insight. The debug counters now support decrement operations using a newly added scmi_dec_count helper, making counter tracking symmetric and more robust. 3. A race condition in suspend-resume logic is being resolved by ensuring SCMI_SYSPOWER_IDLE state is set early during resume, improving suspend reliability under certain conditions. New suspend and resume operations are added to the scmi_bus_type to enable finer power management control for SCMI-based devices. 4. Finally enhancements are also made to avoid registering notifiers for events that a platform does not support, reducing unnecessary overhead by checking for unsupported event types during protocolinitialization. * tag 'scmi-updates-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS firmware: arm_scmi: Avoid notifier registration for unsupported events firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume firmware: arm_scmi: Add power management operations to SCMI bus include: trace: Add tracepoint support for inflight xfer count firmware: arm_scmi: Track number of inflight SCMI transfers firmware: arm_scmi: Add support for debug counter decrement firmware: arm_scmi: Fix up turbo frequencies selection Link: https://lore.kernel.org/r/20250709122907.1171913-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-07-21Merge tag 'smccc-updates-6.17' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers firmware: smccc: Update for v6.17 Just a single update extending arm_smccc_hypervisor_has_uuid() to support both SMC and HVC conduits, enabling UUID retrieval when Linux runs as the root partition under Microsoft Hypervisor (MSHV), where SMC is used. It leverages arm_smccc_1_1_invoke() to dynamically select the appropriate conduit, enhancing compatibility beyond just HVC. * tag 'smccc-updates-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: smccc: Support both smc and hvc conduits for getting hyp UUID Link: https://lore.kernel.org/r/20250709122615.1171419-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-07-21spidev: introduce trivial abb sensor deviceMark Brown
Merge series from Heiko Schocher <hs@denx.de>: This series introduces the changes needed for trivial spi based sensors from ABB, currently operated from userspace.
2025-07-21thunderbolt: Fix copy+paste error in match_service_id()Eric Biggers
The second instance of TBSVC_MATCH_PROTOCOL_VERSION seems to have been intended to be TBSVC_MATCH_PROTOCOL_REVISION. Fixes: d1ff70241a27 ("thunderbolt: Add support for XDomain discovery protocol") Cc: stable <stable@kernel.org> Signed-off-by: Eric Biggers <ebiggers@kernel.org> Link: https://lore.kernel.org/r/20250721050136.30004-1-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-21usb: typec: ucsi: Update power_supply on power role changeMyrrh Periwinkle
The current power direction of an USB-C port also influences the power_supply's online status, so a power role change should also update the power_supply. Fixes an issue on some systems where plugging in a normal USB device in for the first time after a reboot will cause upower to erroneously consider the system to be connected to AC power. Cc: stable <stable@kernel.org> Fixes: 0e6371fbfba3 ("usb: typec: ucsi: Report power supply changes") Signed-off-by: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://lore.kernel.org/r/20250721-fix-ucsi-pwr-dir-notify-v1-1-e53d5340cb38@qtmlabs.xyz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-21usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and DefaultBenson Leung
ucsi_psy_get_current_max would return 0mA as the maximum current if UCSI detected a BC or a Default USB Power sporce. The comment in this function is true that we can't tell the difference between DCP/CDP or SDP chargers, but we can guarantee that at least 1-unit of USB 1.1/2.0 power is available, which is 100mA, which is a better fallback value than 0, which causes some userspaces, including the ChromeOS power manager, to regard this as a power source that is not providing any power. In reality, 100mA is guaranteed from all sources in these classes. Signed-off-by: Benson Leung <bleung@chromium.org> Reviewed-by: Jameson Thies <jthies@google.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com> Link: https://lore.kernel.org/r/20250717200805.3710473-1-bleung@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-21usb: typec: fusb302: cache PD RX stateSebastian Reichel
This patch fixes a race condition communication error, which ends up in PD hard resets when losing the race. Some systems, like the Radxa ROCK 5B are powered through USB-C without any backup power source and use a FUSB302 chip to do the PD negotiation. This means it is quite important to avoid hard resets, since that effectively kills the system's power-supply. I've found the following race condition while debugging unplanned power loss during booting the board every now and then: 1. lots of TCPM/FUSB302/PD initialization stuff 2. TCPM ends up in SNK_WAIT_CAPABILITIES (tcpm_set_pd_rx is enabled here) 3. the remote PD source does not send anything, so TCPM does a SOFT RESET 4. TCPM ends up in SNK_WAIT_CAPABILITIES for the second time (tcpm_set_pd_rx is enabled again, even though it is still on) At this point I've seen broken CRC good messages being send by the FUSB302 with a logic analyzer sniffing the CC lines. Also it looks like messages are being lost and things generally going haywire with one of the two sides doing a hard reset once a broken CRC good message was send to the bus. I think the system is running into a race condition, that the FIFOs are being cleared and/or the automatic good CRC message generation flag is being updated while a message is already arriving. Let's avoid this by caching the PD RX enabled state, as we have already processed anything in the FIFOs and are in a good state. As a side effect that this also optimizes I2C bus usage :) As far as I can tell the problem theoretically also exists when TCPM enters SNK_WAIT_CAPABILITIES the first time, but I believe this is less critical for the following reason: On devices like the ROCK 5B, which are powered through a TCPM backed USB-C port, the bootloader must have done some prior PD communication (initial communication must happen within 5 seconds after plugging the USB-C plug). This means the first time the kernel TCPM state machine reaches SNK_WAIT_CAPABILITIES, the remote side is not sending messages actively. On other devices a hard reset simply adds some extra delay and things should be good afterwards. Fixes: c034a43e72dda ("staging: typec: Fairchild FUSB302 Type-c chip driver") Cc: stable <stable@kernel.org> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://lore.kernel.org/r/20250704-fusb302-race-condition-fix-v1-1-239012c0e27a@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-21usb: typec: ucsi: yoga-c630: add DRM dependencyArnd Bergmann
Selecting DRM_AUX_HPD_BRIDGE is not possible from a built-in driver when CONFIG_DRM=m: WARNING: unmet direct dependencies detected for DRM_AUX_HPD_BRIDGE Depends on [m]: HAS_IOMEM [=y] && DRM [=m] && DRM_BRIDGE [=y] && OF [=y] Selected by [y]: - UCSI_LENOVO_YOGA_C630 [=y] && USB_SUPPORT [=y] && TYPEC [=y] && TYPEC_UCSI [=y] && EC_LENOVO_YOGA_C630 [=y] && DRM_BRIDGE [=y] && OF [=y] arm-linux-gnueabi-ld: drivers/gpu/drm/bridge/aux-hpd-bridge.o: in function `drm_aux_hpd_bridge_notify': aux-hpd-bridge.c:(.text.drm_aux_hpd_bridge_notify+0x28): undefined reference to `drm_bridge_hpd_notify' arm-linux-gnueabi-ld: drivers/gpu/drm/bridge/aux-hpd-bridge.o: in function `drm_aux_hpd_bridge_probe': aux-hpd-bridge.c:(.text.drm_aux_hpd_bridge_probe+0x20): undefined reference to `__devm_drm_bridge_alloc' Add a dependency to force UCSI_LENOVO_YOGA_C630 to be a loadable module as well in this configuration. Fixes: eb90d36bfa06 ("usb: typec: ucsi: yoga-c630: register DRM HPD bridge") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://lore.kernel.org/r/20250717133045.991254-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-21usb: gadget : fix use-after-free in composite_dev_cleanup()Tao Xue
1. In func configfs_composite_bind() -> composite_os_desc_req_prepare(): if kmalloc fails, the pointer cdev->os_desc_req will be freed but not set to NULL. Then it will return a failure to the upper-level function. 2. in func configfs_composite_bind() -> composite_dev_cleanup(): it will checks whether cdev->os_desc_req is NULL. If it is not NULL, it will attempt to use it.This will lead to a use-after-free issue. BUG: KASAN: use-after-free in composite_dev_cleanup+0xf4/0x2c0 Read of size 8 at addr 0000004827837a00 by task init/1 CPU: 10 PID: 1 Comm: init Tainted: G O 5.10.97-oh #1 kasan_report+0x188/0x1cc __asan_load8+0xb4/0xbc composite_dev_cleanup+0xf4/0x2c0 configfs_composite_bind+0x210/0x7ac udc_bind_to_driver+0xb4/0x1ec usb_gadget_probe_driver+0xec/0x21c gadget_dev_desc_UDC_store+0x264/0x27c Fixes: 37a3a533429e ("usb: gadget: OS Feature Descriptors support") Cc: stable <stable@kernel.org> Signed-off-by: Tao Xue <xuetao09@huawei.com> Link: https://lore.kernel.org/r/20250721093908.14967-1-xuetao09@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-21usb: chipidea: imx: Add a missing blank lineDan Carpenter
Fix a checkpatch warning: CHECK: Please use a blank line after function/struct/union/enum declarations Reported-by: Xu Yang <xu.yang_2@nxp.com> Acked-by: Peter Chen <peter.chen@kernel.org> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/36d1c961-319e-4457-bdc1-69f8b6bed33e@sabinyo.mountain Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-21usb: gadget: f_uac1: replace scnprintf() with sysfs_emit()Sumanth Gavini
Documentation/filesystems/sysfs.rst mentions that show() should only use sysfs_emit() or sysfs_emit_at() when formating the value to be returned to user space. So replace scnprintf() with sysfs_emit(). Signed-off-by: Sumanth Gavini <sumanth.gavini@yahoo.com> Link: https://lore.kernel.org/r/20250718175037.299710-1-sumanth.gavini@yahoo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-21usb: usblp: clean up assignment inside if conditionsDarshan Rathod
This patch cleans up a few cases where assignments were made inside of if conditions, like if ((rv = func()) < 0) into two lines, to improve readability and be more in-line with Linux kernel coding style. It also cleans up checkpatch warnings like: ERROR: do not use assignment in if condition No functional change, just a style and maintainability fix. Signed-off-by: Darshan Rathod <darshan.rathod@siqol.com> Link: https://lore.kernel.org/r/20250718091045.264129-1-darshan.rathod@siqol.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-21usb: gadget: uvc: Initialize frame-based format color matching descriptorAkash Kumar
Fix NULL pointer crash in uvcg_framebased_make due to uninitialized color matching descriptor for frame-based format which was added in commit f5e7bdd34aca ("usb: gadget: uvc: Allow creating new color matching descriptors") that added handling for uncompressed and mjpeg format. Crash is seen when userspace configuration (via configfs) does not explicitly define the color matching descriptor. If color_matching is not found, config_group_find_item() returns NULL. The code then jumps to out_put_cm, where it calls config_item_put(color_matching);. If color_matching is NULL, this will dereference a null pointer, leading to a crash. [ 2.746440] Unable to handle kernel NULL pointer dereference at virtual address 000000000000008c [ 2.756273] Mem abort info: [ 2.760080] ESR = 0x0000000096000005 [ 2.764872] EC = 0x25: DABT (current EL), IL = 32 bits [ 2.771068] SET = 0, FnV = 0 [ 2.771069] EA = 0, S1PTW = 0 [ 2.771070] FSC = 0x05: level 1 translation fault [ 2.771071] Data abort info: [ 2.771072] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 2.771073] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 2.771074] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 2.771075] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000a3e59000 [ 2.771077] [000000000000008c] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 2.771081] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 2.771084] Dumping ftrace buffer: [ 2.771085] (ftrace buffer empty) [ 2.771138] CPU: 7 PID: 486 Comm: ln Tainted: G W E 6.6.58-android15 [ 2.771139] Hardware name: Qualcomm Technologies, Inc. SunP QRD HDK (DT) [ 2.771140] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 2.771141] pc : __uvcg_fill_strm+0x198/0x2cc [ 2.771145] lr : __uvcg_iter_strm_cls+0xc8/0x17c [ 2.771146] sp : ffffffc08140bbb0 [ 2.771146] x29: ffffffc08140bbb0 x28: ffffff803bc81380 x27: ffffff8023bbd250 [ 2.771147] x26: ffffff8023bbd250 x25: ffffff803c361348 x24: ffffff803d8e6768 [ 2.771148] x23: 0000000000000004 x22: 0000000000000003 x21: ffffffc08140bc48 [ 2.771149] x20: 0000000000000000 x19: ffffffc08140bc48 x18: ffffffe9f8cf4a00 [ 2.771150] x17: 000000001bf64ec3 x16: 000000001bf64ec3 x15: ffffff8023bbd250 [ 2.771151] x14: 000000000000000f x13: 004c4b40000f4240 x12: 000a2c2a00051615 [ 2.771152] x11: 000000000000004f x10: ffffffe9f76b40ec x9 : ffffffe9f7e389d0 [ 2.771153] x8 : ffffff803d0d31ce x7 : 000f4240000a2c2a x6 : 0005161500028b0a [ 2.771154] x5 : ffffff803d0d31ce x4 : 0000000000000003 x3 : 0000000000000000 [ 2.771155] x2 : ffffffc08140bc50 x1 : ffffffc08140bc48 x0 : 0000000000000000 [ 2.771156] Call trace: [ 2.771157] __uvcg_fill_strm+0x198/0x2cc [ 2.771157] __uvcg_iter_strm_cls+0xc8/0x17c [ 2.771158] uvcg_streaming_class_allow_link+0x240/0x290 [ 2.771159] configfs_symlink+0x1f8/0x630 [ 2.771161] vfs_symlink+0x114/0x1a0 [ 2.771163] do_symlinkat+0x94/0x28c [ 2.771164] __arm64_sys_symlinkat+0x54/0x70 [ 2.771164] invoke_syscall+0x58/0x114 [ 2.771166] el0_svc_common+0x80/0xe0 [ 2.771168] do_el0_svc+0x1c/0x28 [ 2.771169] el0_svc+0x3c/0x70 [ 2.771172] el0t_64_sync_handler+0x68/0xbc [ 2.771173] el0t_64_sync+0x1a8/0x1ac Initialize color matching descriptor for frame-based format to prevent NULL pointer crash by mirroring the handling done for uncompressed and mjpeg formats. Fixes: 7b5a58952fc3 ("usb: gadget: uvc: configfs: Add frame-based frame format support") Cc: stable <stable@kernel.org> Signed-off-by: Akash Kumar <quic_akakum@quicinc.com> Link: https://lore.kernel.org/r/20250718085138.1118788-1-quic_akakum@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-21cdc-acm: fix race between initial clearing halt and openOliver Neukum
On the devices that need their endpoints to get an initial clear_halt, this needs to be done before the devices can be opened. That means it needs to be before the devices are registered. Fixes: 15bf722e6f6c0 ("cdc-acm: Add support of ATOL FPrint fiscal printers") Cc: stable <stable@kernel.org> Signed-off-by: Oliver Neukum <oneukum@suse.com> Link: https://lore.kernel.org/r/20250717141259.2345605-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>