Add driver for the ESWIN EIC7700 high-speed peripherals system
clock controller and register an auxiliary device for system
reset controller which is named as "hsp-reset".
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Xuyang Dong <dongxuyang@eswincomputing.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Add bindings for the high-speed peripherals clock and reset generator
on the ESWIN EIC7700 HSP.
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Xuyang Dong <dongxuyang@eswincomputing.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
The gate_noc_nsp_clk provides the essential clock source for NPU,
DSP, and PCIe subsystems. During kernel init, the clock framework
attempts to disable unused clocks when clk_ignore_unused kernel
parameter is not set.
However, gate_noc_nsp_clk is required to remain enabled for these
critical subsystems to function properly, causing PCIe boot failures
when auto-disabled.
Add CLK_IGNORE_UNUSED flag to gate_noc_nsp_clk to ensure it stays
enabled even when clk_ignore_unused is not specified in kernel
command line.
Fixes: cd44f127c1 ("clk: eswin: Add eic7700 clock driver")
Signed-off-by: Xuyang Dong <dongxuyang@eswincomputing.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
When using driver on Zynq-7000 (32-bit) determine_rate calculation
overflows. For instance requesting 32MHz with 100MHz parent clock
results in 100000000*(4*1000+0) 32-bit multiplication.
Replace the expression with mult_frac which is already used in
clk_wzrd_recalc_ratef.
Cc: stable@vger.kernel.org
Fixes: 7681f64e64 ("clk: clocking-wizard: calculate dividers fractional parts")
Signed-off-by: Pale Löbl <pavel@loebl.cz>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
The buffer length is known to be KUNIT_PARAM_DESC_SIZE
Signed-off-by: David Laight <david.laight.linux@gmail.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Simplify allocation by using a flexible array member and kzalloc_flex to
combine allocations.
Add __counted_by for extra runtime analysis. Move counting variable
assignment to right after allocation. kzalloc_flex does this
automatically with GCC >= 15.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
- Introduce 'clk-scmi-oem.c' to support vendor-specific OEM extensions
for the SCMI clock driver, allows clean integration of vendor-specific
features without impacting the core SCMI clock driver logic.
- Extend 'clk-scmi.h' with 'scmi_clk_oem' structure and related
declarations.
- Initialize OEM extensions via 'scmi_clk_oem_init()'.
- Support querying OEM-specific features and setting spread spectrum.
- Pass 'scmi_device' to 'scmi_clk_ops_select()' for OEM data access.
Reviewed-by: Sebin Francis <sebin.francis@ti.com>
Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Added a new header file 'clk-scmi.h' to define common structures and
interfaces for the SCMI clock driver. This header will also be used by
OEM-specific extensions to ensure consistency and reusability.
Moved relevant structure definitions from the driver implementation to
'clk-scmi.h' to facilitate shared usage.
Reviewed-by: Sebin Francis <sebin.francis@ti.com>
Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Add KUnit test coverage for the assigned-clock-sscs DT property that
configures spread spectrum on clocks before they are used.
Extend the existing test infrastructure to support spread spectrum:
- Add struct clk_spread_spectrum field to clk_dummy_context and a
clk_dummy_set_spread_spectrum callback
- Wire set_spread_spectrum into all dummy clock ops
- Extend clk_assigned_rates_register_clk and test parameter struct
to propagate initial SSCS values
Add a new separate test suite clk_assigned_sscs with three categories:
1. clk_assigned_sscs_assigns_one — verifies that a single
assigned-clock-sscs entry correctly configures spread spectrum
on one clock, testing both provider and consumer paths
2. clk_assigned_sscs_assigns_multiple — verifies that multiple
assigned-clock-sscs entries configure spread spectrum on two
clocks, testing both provider and consumer paths
3. clk_assigned_sscs_skips — verifies that malformed DT properties
are correctly skipped without error: missing assigned-clocks,
zero-valued SSCS, and null phandles, tested for both provider
and consumer scenarios
New DT overlays are added for all test scenarios:
- kunit_clk_assigned_sscs_one{,consumer} — single valid entry
- kunit_clk_assigned_sscs_multiple{,consumer} — two valid entries
- kunit_clk_assigned_sscs_without{,consumer} — missing assigned-clocks
- kunit_clk_assigned_sscs_zero{,consumer} — all-zero SSCS values
- kunit_clk_assigned_sscs_null{,consumer} — null phandle
Co-developed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Parse the Spread Spectrum Configuration(SSC) from device tree and configure
them before using the clock.
Each SSC is three u32 elements which means '<modfreq spreaddepth
modmethod>', so assigned-clock-sscs is an array of multiple three u32
elements.
Reviewed-by: Brian Masney <bmasney@redhat.com>
Reviewed-by: Sebin Francis <sebin.francis@ti.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Add clk_hw_set_spread_spectrum to configure a clock to enable spread
spectrum feature. set_spread_spectrum ops is added for clk drivers to
have their own hardware specific implementation.
Reviewed-by: Brian Masney <bmasney@redhat.com>
Reviewed-by: Sebin Francis <sebin.francis@ti.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Per dt-schema, the modulation methods are: down-spread(3), up-spread(2),
center-spread(1), no-spread(0). So define them in dt-bindings to avoid
write the magic number in device tree.
Reviewed-by: Brian Masney <bmasney@redhat.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Sebin Francis <sebin.francis@ti.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
The "reg" property is an address-sized DT cell property. The AT91
compat clock parser only uses a small bus id from it, but reading it
with the u8 helper does not match the property encoding.
Use of_property_read_reg() so the code goes through the helper for
"reg" properties, then keep the existing range check before passing
the bus id to the clock registration code.
Assisted-by: Codex:gpt-5-5
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
The rate set_rate helpers perform a read-modify-write on the divider
and multiplier registers but only ever OR the new value in, without
first masking off the existing field. The first write after reset lands
on a zeroed field and looks correct, but any later reprogramming leaves
the old bits set: the field becomes the bitwise OR of the previous and
new encodings, corrupting the divider or multiplier.
Mask off each field before writing the new value so reprogramming a
clock to a different rate produces the intended register contents.
Fixes: a7b7c7c6c0 ("clk: canaan: Add clock driver for Canaan K230")
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Acked-by: Xukai Wang <kingxukai@zohomail.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
The driver was introduced in 2021 and since then only supports a single
chip variant. Simplify the driver by hard-coding the device properties
instead of using the id_table's abstraction for a single chip type.
While touching the id table, use a single space in the table terminator
to match the most used style.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
vc7_probe() registers the APLL with clk_register_fixed_rate(), which is
not devm-managed and must be explicitly unregistered on probe failure.
Most later errors already unwind through err_clk, but a failure from
vc7_get_bank_clk() in the output registration loop returned directly.
That skipped clk_unregister_fixed_rate() and leaked the APLL clock.
Route that error through the existing err_clk label so the fixed-rate
clock is released consistently with the other probe failure paths.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 48c5e98fed ("clk: Renesas versaclock7 ccf device driver")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
of_find_compatible_node() returns a device node with its reference count
incremented. mxc_init_irq() looks up the i.MX25 CCM node for of_iomap()
and the AVIC node for irq_domain_create_legacy(), but does not release
either temporary reference.
of_iomap() does not consume the node reference, and
irq_domain_create_legacy() takes its own fwnode reference for the domain.
Drop the temporary OF node references after each use.
Fixes: 9b454d16e5 ("ARM: imx: avic: set low-power interrupt mask for imx25")
Fixes: 544496ab5c ("ARM: imx: move irq_domain_add_legacy call into avic driver")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Reviewed-by: Martin Kaiser <martin@kaiser.cx>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
ti_sci_probe() publishes the controller on the global ti_sci_list
before creating child devices. If of_platform_populate() fails
after creating some children, the probe error path leaves the
children around and leaves the failed controller visible through
ti_sci_get_handle().
Depopulate any children created by the failed populate call and remove
the controller from the global list before returning the probe error.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260616004741.1726-1-pengpeng@iscas.ac.cn
Signed-off-by: Nishanth Menon <nm@ti.com>
The manual page-program path used the UMA command byte for the
first byte of each continuation chunk. That forced command-lane
semantics onto chunked writes and blocked dual/quad payload
writes.
Switch continuation chunks to data-only UMA transactions so WDBPCK
controls the payload bus width.
Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Link: https://patch.msgid.link/20260609071458.2692482-1-tmaimon77@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The stmmac hardware on Agilex5 supports 8 TX/RX queue pairs and is
dma-coherent. Update the schema to handle the hardware differences
between SoC variants.
Also make 'interrupts' and 'interrupt-names' as required properties.
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
---
v2: Set the top level interrupts to include the widest contraints(1-17)
Just have 1 list of all interrupt-names
Update commit message to include 'interrupts' and 'interrupt-names'
as required properties
Change minItems 1 to maxItems 1 for non agilex5 variants
Add same constraint for interrupt-names
Flavien Solt reported lifetime issues with the CXL MCE notifier, which
can lead to NULL dereferences and use-after-free in the MCE handler.
The notifier was registered per memory device and stored in 'struct
cxl_memdev_state', even though it only needs the region state (the
region's SPA range and its extended linear cache size).
Instead of keeping the memory device and endpoint alive, the correct fix
is to move the notifier into 'struct cxl_region' and register it from
cxl_region_probe() as it should be a per-region notifier. Setup the
registration to only happen for regions that have an extended linear
cache as that is the only current usage.
Remove cxl_port_get_spa_cache_alias() as it is now dead code.
[ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ]
Reported-by: Flavien Solt <flavien@nus.edu.sg>
Suggested-by: Dan Williams <djbw@kernel.org>
Fixes: 516e5bd0b6 ("cxl: Add mce notifier to emit aliased address for extended linear cache")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Ben Cheatham <benjamin.cheatham@amd.com>
Link: https://patch.msgid.link/20260616224912.2567474-1-dave.jiang@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
The driver's design intent is that missing or malformed component
registers should not prevent mailbox initialization. cxl_pci_probe()
already reflects this: the CXL_REGLOC_RBI_COMPONENT setup path only
emits a dev_warn() and continues when component registers are absent,
rather than returning an error.
The check 'if (!cxlds->reg_map.device_map.mbox.valid)' violates this
intent and is also technically incorrect for two reasons:
1. Wrong struct: the MEMDEV register block is enumerated into a local
variable 'map', not into 'cxlds->reg_map'. The device_map.mbox.valid
field inside cxlds->reg_map is never written by the MEMDEV probe and
will always read as zero regardless of actual hardware capability.
2. Already validated: cxl_pci_setup_regs(CXL_REGLOC_RBI_MEMDEV) calls
cxl_probe_regs() which explicitly checks mbox.valid and returns
-ENXIO if the mailbox is absent. If that check passes, the mailbox is
guaranteed to be present by the time cxl_pci_type3_init_mailbox() is
called.
The value that the check actually reads is component_map.ras.valid,
which aliases device_map.mbox.valid in the union. This is populated by
the COMPONENT probe, not the MEMDEV probe. On devices where the
component register BAR does not implement a CXL Component Capability
Array (e.g. certain DCD devices), cxl_probe_component_regs() returns
early leaving ras.valid=false. Through the union, this makes mbox.valid
read as false, causing cxl_pci_type3_init_mailbox() to return -ENODEV
(-19) even though the mailbox hardware is fully functional.
Remove the check. Mailbox presence has already been validated by
cxl_pci_setup_regs(CXL_REGLOC_RBI_MEMDEV). The presence or absence of
component registers is irrelevant to mailbox initialization.
Fixes: 8d8081cecf ("cxl: Move mailbox related bits to the same context")
Reviewed-by: Richard Cheng <icheng@nvidia.com>
Signed-off-by: Wei Hou <wei.hou@scaleflux.com>
Reviewed-by: Li Ming <ming.li@zohomail.com>
Link: https://patch.msgid.link/20260628155857.239866-1-wei.hou@scaleflux.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Fix the PCIe outbound memory ranges for both pcie1 controllers on i.MX943.
The memory window size was incorrectly set to 256MB during initial
bring-up, but the hardware supports up to 4GB of outbound address space
per controller.
Additionally, the ECAM region cannot be mapped as I/O space. Use a
memory-mapped region for I/O space instead, and relocate the 1MB I/O
region to immediately follow the memory region at offset 0xf0000000
within each window.
Update the outbound address space layout per controller as follows:
- 3.5GB 64-bit prefetchable memory
- 256MB 32-bit non-prefetchable memory
- 1MB I/O
Fixes: fa6067fd8e ("arm64: dts: imx943: Add pcie1 and pcie1-ep supports")
Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Fix the PCIe outbound memory ranges for both pcie0 controllers on i.MX94.
The memory window size was incorrectly set to 256MB during initial
bring-up, but the hardware supports up to 4GB of outbound address space
per controller.
Additionally, the ECAM region cannot be mapped as I/O space. Use a
memory-mapped region for I/O space instead, and relocate the 1MB I/O
region to immediately follow the memory region at offset 0xf0000000
within each window.
Update the outbound address space layout per controller as follows:
- 3.5GB 64-bit prefetchable memory
- 256MB 32-bit non-prefetchable memory
- 1MB I/O
Fixes: 8cd439f177 ("arm64: dts: imx94: Add pcie0 and pcie0-ep supports")
Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Pull in tag v7.2-rc1 so that drm-misc-fixes becomes useful again,
and drm-misc-next-fixes can be closed.
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
Baijie Helper A133 board is a development board around Baijie A133 Core
SBC. Features:
- 1/2/4GiB LPDDR4 DRAM
- 8/16/32GiB eMMC
- AXP707 PMIC
- USB-C OTG port in peripheral mode (via onboard hub)
- 2 USB 2.0 ports
- MicroSD slot and on-board eMMC module
- Gigabit Ethernet
- Bluetooth
- WiFi
Add initial support for both the Helper and Core boards, including UART,
PMU, eMMC, USB, Ethernet, LRADC-connected buttons.
UART1 can only be used for Bluetooth module, but BT-WiFi combo Allwinner
AW869A chip has no mainline driver currently.
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://patch.msgid.link/20260623204824.691832-7-alexander.sverdlin@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
A100/A133 SoCs feature a Low Rate ADC (LRADC) for Key application.
Specs:
- Power supply voltage: 1.8 V
- Reference voltage: 1.35 V
- Interrupt support
- Support Hold Key and General Key
- Support normal, continue and single work mode
- 6-bits resolution, sample rate up to 2 kHz
- Voltage input range between 0 and 1.35 V
Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://patch.msgid.link/20260623204824.691832-6-alexander.sverdlin@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
The Allwinner A100/A133 SoCs have an LRADC which is compatible with the
versions in existing SoCs. Add a compatible string for A100, with the R329
fallback.
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260623204824.691832-5-alexander.sverdlin@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Baijie HelperBoard A133 is a development board around their A133 Core
board. Introduce a compatible for both the Core and the development
boards.
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://patch.msgid.link/20260623204824.691832-4-alexander.sverdlin@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Shenzhen Baijie Technology Co., Ltd. focuses on R&D and production of
embedded products as well as customization of embedded solutions.
Link: https://szbaijie.com/
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Paul Kocialkowski <paulk@sys-base.io>
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://patch.msgid.link/20260623204824.691832-3-alexander.sverdlin@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
atk_ec_present() walks the management group package returned by the GGRP
ACPI method and, for each sub-package, reads its first element:
id = &obj->package.elements[0];
if (id->type != ACPI_TYPE_INTEGER)
without checking that the sub-package is non-empty. ACPICA allocates the
element array with exactly package.count entries, so for a sub-package
with a zero count this reads past the allocation.
The sibling function atk_debugfs_ggrp_open() performs the same access but
skips empty packages with a package.count check first. Add the same
check to atk_ec_present() so a malformed firmware package cannot trigger
an out-of-bounds read.
Fixes: 9e6eba610c ("hwmon: (asus_atk0110) Enable the EC")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://lore.kernel.org/r/20260619122746.721981-1-sammiee5311@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Expand the table borders (upper & lower) to prevent a documentation
build error:
Documentation/hwmon/ltc4283.rst:261: ERROR: Malformed table.
Text in column margin in table line 3.
======================= ==========================================
power1_failed_fault_log Set to 1 by a power1 fault occurring.
power1_good_input_fault_log Set to 1 by a power1 good input fault occurring at PGIO3.
Fixes: dd63353a0b ("hwmon: ltc4283: Add support for the LTC4283 Swap Controller")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20260620011833.3568693-1-rdunlap@infradead.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
pmbus_data2reg_vid() hardcoded the VR11 encoding regardless of the
vrm_version configured by the driver, while pmbus_reg2data_vid()
already switched on it. Any driver that selects a non-VR11 VID mode
and exposes a regulator (or hwmon vout setter) sent dangerously
wrong codes to PMBUS_VOUT_COMMAND -- e.g. an nvidia195mv part asked
for 200 mV got the VR11 clamp to 500 mV encoded as 0xB2, which the
chip interprets as 1080 mV.
Mirror pmbus_reg2data_vid() so writes round-trip with reads.
Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
Assisted-by: Claude:claude-opus-4-7 [Claude Code]
Link: https://lore.kernel.org/r/20260620-pmbus-data2reg-vid-v1-1-5518030432c4@nexthop.ai
Fixes: 068c227056 ("hwmon: (pmbus) Add support for VR12")
Fixes: d4977c083a ("hwmon: (pmbus) Add support for Intel VID protocol VR13")
Fixes: 9d72340b6a ("hwmon: (pmbus/core) Add support for Intel IMVP9 and AMD 6.25mV modes")
Fixes: 969a4ec86c ("hwmon: (pmbus/core) Add support for NVIDIA nvidia195mv mode")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Current _start and _stop ops are implemented using various APIs from the
platform management firmware driver. Instead provide respective RPU
start and stop API in the firmware driver and move the logic to interact
with the PM firmware in the firmware driver. The remoteproc driver doesn't
need to know actual logic, but only the final result i.e. RPU start/stop
was success or not. This refactor keeps the remoteproc driver simple and
moves firmware interaction logic to the firmware driver.
Signed-off-by: Tanmay Shah <tanmay.shah@amd.com>
Acked-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/20260619163854.410392-1-tanmay.shah@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
occ_active(false) and occ_shutdown() unregister sysfs-backed devices while
occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can
wait for active sysfs callbacks to drain, and those callbacks can enter the
OCC update path and try to take occ->lock again. That gives the unregister
paths the lock ordering occ->lock -> sysfs callback drain, while a callback
has the opposite edge sysfs callback -> occ->lock.
This issue was found by our static analysis tool and then manually
reviewed against the current tree.
The grounded PoC kept the real unregister and callback carrier:
occ_shutdown()
hwmon_device_unregister()
occ_show_temp_1()
occ_update_response()
Lockdep reported the circular dependency with occ_shutdown() already
holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs
side:
WARNING: possible circular locking dependency detected
... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv]
... (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv]
occ_update_response.isra.0+0xb/0x20 [vuln_msv]
occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv]
*** DEADLOCK ***
Serialize hwmon registration and removal with a separate hwmon_lock.
Under that lock, detach occ->hwmon and update occ->active while occ->lock
is held so concurrent OCC state changes still see a stable state, then
drop occ->lock before calling hwmon_device_unregister(). Remove the
driver sysfs group before taking occ->lock in occ_shutdown(), so draining
the driver attributes cannot wait while the OCC mutex is held. Also make
OCC update callbacks return -ENODEV after deactivation, so callbacks that
already passed sysfs active protection do not poll the hardware after
teardown has detached the hwmon device.
Fixes: 849b0156d9 ("hwmon: (occ) Delay hwmon registration until user request")
Fixes: ac6888ac5a ("hwmon: (occ) Lock mutex in shutdown to prevent race with occ_active")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://lore.kernel.org/r/20260619015938.494464-1-runyu.xiao@seu.edu.cn
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Fix a typo in the CXL mailbox command return code description for the
interrupted-command case.
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Richard Cheng <icheng@nvidia.com>
Reviewed-by: Ira Weiny <iweiny@kernel.org>
Link: https://patch.msgid.link/20260624122835.5656-1-alhouseenyousef@gmail.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
CXL_MEM_SEND_COMMAND bounds the user's in.size to the mailbox payload
size but leaves out.size unbounded, then cxl_mbox_cmd_ctor() calls
kvzalloc(out.size). A large out.size drives a huge allocation, above
INT_MAX it WARNs and taints, and with panic_on_warn=1 it panics.
The transport __cxl_pci_mbox_send_cmd() already clamps the response copy
to min(out.size, payload_size, device len), so the output buffer is
never written beyond payload_size. Clamp the allocation to payload_size
too, matching the RAW path.
Fixes: 583fa5e71c ("cxl/mem: Add basic IOCTL interface")
Reviewed-by: Kai-Heng Feng <kaihengf@nvidia.com>
Reviewed-by: Koba Ko <kobak@nvidia.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Richard Cheng <icheng@nvidia.com>
Link: https://patch.msgid.link/20260624144147.53997-1-icheng@nvidia.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
The OMAP and Keystone remoteproc drivers only need to know whether
"ti,bootreg" and "ti,syscon-dev" are present before parsing them.
Reading those properties as booleans misrepresents their DT encoding.
Use of_property_present() for the presence tests and keep the existing
phandle parsing for the actual property values.
Assisted-by: Codex:gpt-5-5
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://lore.kernel.org/r/20260612214959.1884404-1-robh@kernel.org
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
The board integrates an on-board mux to route shared signals to either
CAN2 or PDM (MICFIL). The mux is controlled by a GPIO.
Add a pinctrl-based multiplexer node to describe this routing and ensure
proper probe ordering of the dependent devices.
Previously, MICFIL operation implicitly depended on the default level of
PCA6416 GPIO3. After adding the pinctrl-multiplexer, make the dependency
explicit.
Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
These entries were previously unaligned with MAINTAINERS, but will be
even more so now that entries are being changed there. Bring them in
sync by replacing the list here with the updated one from MAINTAINERS.
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Frank Binns <frank.binns@imgtec.com>
Reviewed-by: Alessio Belle <alessio.belle@imgtec.com>
Acked-by: Luigi Santivetti <luigi.santivetti@imgtec.com>
Link: https://patch.msgid.link/20260626-maintainer-updates-v2-3-e1b3f246c44c@imgtec.com
Signed-off-by: Matt Coster <matt.coster@imgtec.com>
New people are taking up maintainership roles within the team.
Reviewed-by: Frank Binns <frank.binns@imgtec.com>
Reviewed-by: Alessio Belle <alessio.belle@imgtec.com>
Acked-by: Luigi Santivetti <luigi.santivetti@imgtec.com>
Link: https://patch.msgid.link/20260626-maintainer-updates-v2-2-e1b3f246c44c@imgtec.com
Signed-off-by: Matt Coster <matt.coster@imgtec.com>
There's a bunch of useful information missing from this entry, flesh it
out and simplify the dt-bindings pattern while we're at it.
Reviewed-by: Frank Binns <frank.binns@imgtec.com>
Reviewed-by: Alessio Belle <alessio.belle@imgtec.com>
Acked-by: Luigi Santivetti <luigi.santivetti@imgtec.com>
Link: https://patch.msgid.link/20260626-maintainer-updates-v2-1-e1b3f246c44c@imgtec.com
Signed-off-by: Matt Coster <matt.coster@imgtec.com>
The i.MX93 TMU node compatible need to be updated to apply the SoC
specific configuration and TMU errata workaround.
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Use the shared optional resource-table helper in the remoteproc drivers
that already treat a missing resource table as non-fatal:
xlnx_r5_remoteproc, rcar_rproc, stm32_rproc, imx_rproc, and
imx_dsp_rproc.
Keep thin local parse_fw() wrappers in each driver so the helper only
centralizes the return-value handling while each platform retains
control over whether the missing-table case is logged and at
what severity.
Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>
Tested-by: Peng Fan <peng.fan@nxp.com> #i.MX8MP-EVK
Link: https://lore.kernel.org/r/20260529021637.2077602-6-ben.levinsky@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Add a helper macro around rproc_elf_load_rsc_table() for thin parse_fw()
wrappers that treat a missing ELF resource table as optional while
keeping per-driver logging decisions local to the caller of
rproc_elf_load_rsc_table_optional().
Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>
Tested-by: Peng Fan <peng.fan@nxp.com> #i.MX8MP-EVK
Link: https://lore.kernel.org/r/20260529021637.2077602-5-ben.levinsky@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Carveouts registered through the shared wc-ioremap helper are backed by
I/O memory, but rproc_da_to_va() only reports that to its callers when
mem->is_iomem is set on the carveout.
Without that flag, the remoteproc ELF loader and coredump paths can
fall back to normal memcpy()/memset() accessors instead of the I/O
helpers used for iomapped memory.
Mark shared wc-ioremap carveouts as iomem so the framework uses the
proper memcpy_toio(), memset_io(), and memcpy_fromio() accessors for
these regions.
Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>
Tested-by: Peng Fan <peng.fan@nxp.com> #i.MX8MP-EVK
Link: https://lore.kernel.org/r/20260529021637.2077602-4-ben.levinsky@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
