Commit graph

1,447,411 commits

Author SHA1 Message Date
Ralf Lici
367f4b163a selftests: ovpn: check asymmetric peer-id
Extend the base test to verify that the correct peer-id is set in data
packet headers. This is done by capturing ping packets with tcpdump during
the initial exchange and matching the first portion of the header
against the expected sequence for every connection.

Cc: Shuah Khan <shuah@kernel.org>
Cc: linux-kselftest@vger.kernel.org
Cc: horms@kernel.org
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-03-17 11:09:05 +01:00
Ralf Lici
2e570a5140 ovpn: add support for asymmetric peer IDs
In order to support the multipeer architecture, upon connection setup
each side of a tunnel advertises a unique ID that the other side must
include in packets sent to them. Therefore when transmitting a packet, a
peer inserts the recipient's advertised ID for that specific tunnel into
the peer ID field. When receiving a packet, a peer expects to find its
own unique receive ID for that specific tunnel in the peer ID field.

Add support for the TX peer ID and embed it into transmitting packets.
If no TX peer ID is specified, fallback to using the same peer ID both
for RX and TX in order to be compatible with the non-multipeer compliant
peers.

Cc: horms@kernel.org
Cc: donald.hunter@gmail.com
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
2026-03-17 11:09:05 +01:00
Ralf Lici
77de28cd7c selftests: ovpn: add notification parsing and matching
To verify that netlink notifications are correctly emitted and contain
the expected fields, this commit uses the tools/net/ynl/pyynl/cli.py
script to create multicast listeners. These listeners record the
captured notifications to a JSON file, which is later compared to the
expected output.

Cc: linux-kselftest@vger.kernel.org
Cc: shuah@kernel.org
Cc: horms@kernel.org
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-03-17 11:08:55 +01:00
Ralf Lici
c841b676da ovpn: notify userspace on client float event
Send a netlink notification when a client updates its remote UDP
endpoint. The notification includes the new IP address, port, and scope
ID (for IPv6).

Cc: linux-kselftest@vger.kernel.org
Cc: horms@kernel.org
Cc: shuah@kernel.org
Cc: donald.hunter@gmail.com
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
2026-03-17 11:08:55 +01:00
Qingfang Deng
4a6480599c ovpn: pktid: use bitops.h API
Use bitops.h for replay window to simplify code.

Signed-off-by: Qingfang Deng <dqfext@gmail.com>
[antonio@openvpn.net: extended commit message]
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
2026-03-17 11:08:54 +01:00
Sabrina Dubroca
7e7ca01d91 ovpn: use correct array size to parse nested attributes in ovpn_nl_key_swap_doit
In ovpn_nl_key_swap_doit, the attributes array used to parse the
OVPN_A_KEYCONF uses OVPN_A_PEER_MAX instead of
OVPN_A_KEYCONF_MAX. Note that this does not cause any bug, since
currently OVPN_A_KEYCONF_MAX < OVPN_A_PEER_MAX.

The wrong constant was introduced by commit 203e2bf559
("ovpn: implement key add/get/del/swap via netlink")

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-03-17 11:08:54 +01:00
Antonio Quartulli
a8e136b496 selftests: ovpn: allow compiling ovpn-cli.c with mbedtls3
mbedtls 3 installs headers and calls the shared object
differently than version 2, therefore we must now rely
on pkgconfig to fill the right C/LDFLAGS.

Moreover the mbedtls3 library expects any base64 file to
have their content on one line.
Since this change does no break older versions,
let's change the sample key file format and make mbedtls3
happy.

Cc: Shuah Khan <shuah@kernel.org>
Cc: linux-kselftest@vger.kernel.org
Cc: horms@kernel.org
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-03-17 11:08:54 +01:00
Manivannan Sadhasivam
f2d1643ddc bus: mhi: ep: Test for non-zero return value where applicable
Instead of testing for negative error code, just test for non-zero return
for cases where there is no positive return value. This helps to maintain
code uniformity.

No functional change.

Reported-by: Bjorn Helgaas <helgaas@kernel.org>
Closes: https://lore.kernel.org/linux-pci/20260227191510.GA3904799@bhelgaas
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260302055021.8616-1-manivannan.sadhasivam@oss.qualcomm.com
2026-03-17 15:35:20 +05:30
Rosen Penev
37a23d6f11 bus: mhi: host: Use kzalloc_flex
Change kzalloc + kzalloc to just kzalloc with a flexible array member.

Add __counted_by for extra runtime analysis when requested.

Move counting assignment immediately after allocation as required by
__counted_by.

Move mhi_buf definition as a complete definition as needed for flex
arrays. It's not a pointer anymore.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
[mani: squashed https://lore.kernel.org/mhi/20260317-mhi-invalid-free-mhi-buffers-v1-1-8418a3ad604f@oss.qualcomm.com]
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260312045921.7663-1-rosenp@gmail.com
2026-03-17 15:34:47 +05:30
Qingfang Deng
febe801245 ppp: remove pch->chan NULL checks from tx path
Now that ppp_disconnect_channel() is called before pch->chan is set to
NULL, a channel from ppp->channels list on the transmit path is
guaranteed to have non-NULL pch->chan.

Remove the pch->chan NULL checks from ppp_push(), ppp_mp_explode(), and
ppp_fill_forward_path(), where a channel is obtained from the list.
Remove the corresponding WRITE/READ_ONCE annotations as they no longer
race.

Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Link: https://patch.msgid.link/20260312093732.277254-2-dqfext@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-17 10:58:04 +01:00
Qingfang Deng
6a196e83a1 ppp: disconnect channel before nullifying pch->chan
In ppp_unregister_channel(), pch->chan is set to NULL before calling
ppp_disconnect_channel(), which removes the channel from ppp->channels
list using list_del_rcu() + synchronize_net(). This creates an
intermediate state where the channel is still connected (on the list)
but already unregistered (pch->chan == NULL).

Call ppp_disconnect_channel() before setting pch->chan to NULL. After
the synchronize_net(), no new reader on the transmit path will hold a
reference to the channel from the list.

This eliminates the problematic state, and prepares for removing the
pch->chan NULL checks from the transmit path in a subsequent patch.

Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Link: https://patch.msgid.link/20260312093732.277254-1-dqfext@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-17 10:58:04 +01:00
Nam Cao
56c167a0c0 genirq/matrix, LoongArch: Delete IRQ_MATRIX_BITS leftovers
Delete IRQ_MATRIX_BITS leftovers after commit 5b98d210ac ("genirq/matrix:
Dynamic bitmap allocation") has made IRQ_MATRIX_BITS obsolete.

Signed-off-by: Nam Cao <namcao@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260316072850.467995-1-namcao@linutronix.de
2026-03-17 10:57:03 +01:00
Charles Keepax
b8f2d65fec soundwire: intel_auxdevice: Add cs42l49 to wake_capable_list
The Cirrus Logic cs42l49 codec can generate Jack events so add it to
the wake-capable list.

Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260313155428.1934196-1-ckeepax@opensource.cirrus.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-03-17 15:21:57 +05:30
Bradford Love
a5dcbff7d5 media: em28xx: remove tuner type from Hauppauge DVB DualHD
This reverts a patch which was perhaps inadvertently added.

This was changed during the 5.15-rc4 merge. The faulty commit appears
lost in the pull request somehow, I cannot find it to check the
explanation.

commit c52e7b855b ("Merge tag 'v5.15-rc4' into media_tree")

There was nothing wrong with this device and no reason to moodify the
board profile. The DVB capabilities are added via dvb_module_probe.
Additionally, the device contains *zero* analog inputs, so I'm not
sure why one was added.

Signed-off-by: Bradford Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:19 +01:00
Bradford Love
724e16b166 media: em28xx: Add a variety of DualHD usb id
Include possible vid:pid combination of DualHD models
that are in the wild.

Signed-off-by: Bradford Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:19 +01:00
Bradford Love
5e521401d0 media: au0828: Add new Hauppauge HVR1265 and ImpactVCB-e
New HVR1265 and ImpactVCB-e devices are PCIe baords
with USB controller and essentially embedded
Hauppauge 950Q.

HVR1265 - digital+analog TV, S-Video, and audio inputs
ImpactVCB-e - Composite, S-Video, and audio inputs

This also fixes AU8522_COMPOSITE_CH4, which was missing
from video routing.

Signed-off-by: Bradford Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:19 +01:00
Bradford Love
ca3e8eaaa4 media: saa7164: Fix REV2 firmware filename
The wrong firmware file is listed, leading to non functional devices
on REV2 models.

Signed-off-by: Bradford Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:19 +01:00
Bradford Love
57c3c67fce media: si2168: fw 4.0-11 loses warm state during sleep
Ignoring version 4.0-11 firmware leads to non functional devices
after sleep on all Hauppauge DVB devices containing the si2168 and
firmware version 4.0-11.

Signed-off-by: Bradford Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:19 +01:00
Bradford Love
3c414622fe media: si2168: Fix i2c command timeout on embedded platforms
On many embedded platforms i2c responses through USB are not returned
as quickly, plus constantly banging on the i2c master receive essentially
deadlocks the driver. Inserting a 3ms delay between i2c receive calls
and extending the timeout fixes all tested platforms.

Signed-off-by: Bradford Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:19 +01:00
Bradford Love
69426c6c9b media: cx231xx: Fix AGC levels for NTSC-M
Windows uses the implemented command sequence to set AGC for NTSC-M.
The previous Linux values work, mostly, but on some embedded
platforms NTSC-M is very unstable. The Windows default values
completely fix any signal stability issues and produce a clear image.

Signed-off-by: Bradford Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:19 +01:00
Bradford Love
bad32ae441 media: xc5000: Add rf strength function
Without a rf strength function implemented, analog lock
cannot be detected by standardized command line tools.

Signed-off-by: Bradford Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:19 +01:00
Bradford Love
36200241f5 media: cx25840: Fix NTSC-J, PAL-N, and SECAM standards
Formats did not correctly decode prior.

Modifications are based off cx25840 datasheet.

Signed-off-by: Bradford Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:19 +01:00
Bradford Love
9cddeb883b media: si2157: Analog format fixes
Updates to support PAL-N and PAL-Nc
Verifies PAL-I and PAL-DK standards are working
Fixes and verifies SECAM-L now works

Signed-off-by: Bradford Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:19 +01:00
Faizel K B
24ae633ab3 media: vimc: streamer: Apply sensor frame rate in streamer thread
Use the sensor's pre-calculated jiffies value to add appropriate
delay between frames according to the configured timing value.
The actual frame rate  will vary depending on processing delays in
other media pipeline components.

Tested using yavta frame rate display with QCIF resolution:
yavta <video-node> --capture=<no_of_frames>

Signed-off-by: Faizel K B <faizel.kb@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:19 +01:00
Faizel K B
ec1e620b24 media: vimc: sensor: Add pixel_rate,vblank and hblank configuration
pixel_rate and hblank as read only parameter. vblank can be configured
to match the desired frame rate.

Default values are, pixel_rate - 160 MHz, hblank - 800.
vblank defaults to an equivalent value of 30 fps for resolutions less than
or equal to 1920x1080 and 10 fps for higher resolutions. For higher
resolutions, modify pixel_rate in the driver code.
fps = pixel_rate / ((width + hblank) * (height + vblank))
minimum vblank - 4, maximum vblank - 65535

The configured fps delay is pre-calculated into jiffies and
stored in the sensor's hw structure for efficient access by the
streamer thread.

Signed-off-by: Faizel K B <faizel.kb@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:19 +01:00
Faizel K B
12cdc242c3 media: vimc: sensor: Move vimc_sensor_device to common header
Move the vimc_sensor_device structure from vimc-sensor.c to
vimc-common.h to make it accessible to the vimc-streamer component.

Signed-off-by: Faizel K B <faizel.kb@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:18 +01:00
Artem Lytkin
03fd5070c5 staging: media: av7110: replace BUG() with error return in gpioirq
Replace BUG() with a return statement in the gpioirq tasklet handler.
If saa7146_wait_for_debi_done() times out, crashing the kernel is
disproportionate. The pr_err() already logs the failure, and returning
early avoids accessing hardware in a potentially broken state.

Signed-off-by: Artem Lytkin <iprintercanon@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:18 +01:00
Jeongjun Park
8bd29dbe03 media: as102: fix to not free memory after the device is registered in as102_usb_probe()
In as102_usb driver, the following race condition occurs:
```
		CPU0						CPU1
as102_usb_probe()
  kzalloc(); // alloc as102_dev_t
  ....
  usb_register_dev();
						fd = sys_open("/path/to/dev"); // open as102 fd
						....
  usb_deregister_dev();
  ....
  kfree(); // free as102_dev_t
  ....
						sys_close(fd);
						  as102_release() // UAF!!
						    as102_usb_release()
						      kfree(); // DFB!!
```

When a USB character device registered with usb_register_dev() is later
unregistered (via usb_deregister_dev() or disconnect), the device node is
removed so new open() calls fail. However, file descriptors that are
already open do not go away immediately: they remain valid until the last
reference is dropped and the driver's .release() is invoked.

In as102, as102_usb_probe() calls usb_register_dev() and then, on an
error path, does usb_deregister_dev() and frees as102_dev_t right away.
If userspace raced a successful open() before the deregistration, that
open FD will later hit as102_release() --> as102_usb_release() and access
or free as102_dev_t again, occur a race to use-after-free and
double-free vuln.

The fix is to never kfree(as102_dev_t) directly once usb_register_dev()
has succeeded. After deregistration, defer freeing memory to .release().

In other words, let release() perform the last kfree when the final open
FD is closed.

Cc: <stable@vger.kernel.org>
Reported-by: syzbot+47321e8fd5a4c84088db@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=47321e8fd5a4c84088db
Fixes: cd19f7d3e3 ("[media] as102: fix leaks at failure paths in as102_usb_probe()")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:18 +01:00
Jeongjun Park
3b7da2b4d0 media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
In hackrf driver, the following race condition occurs:
```
		CPU0						CPU1
hackrf_probe()
  kzalloc(); // alloc hackrf_dev
  ....
  v4l2_device_register();
  ....
						fd = sys_open("/path/to/dev"); // open hackrf fd
						....
  v4l2_device_unregister();
  ....
  kfree(); // free hackrf_dev
  ....
						sys_ioctl(fd, ...);
						  v4l2_ioctl();
						    video_is_registered() // UAF!!
						....
						sys_close(fd);
						  v4l2_release() // UAF!!
						    hackrf_video_release()
						      kfree(); // DFB!!
```

When a V4L2 or video device is unregistered, the device node is removed so
new open() calls are blocked.

However, file descriptors that are already open-and any in-flight I/O-do
not terminate immediately; they remain valid until the last reference is
dropped and the driver's release() is invoked.

Therefore, freeing device memory on the error path after hackrf_probe()
has registered dev it will lead to a race to use-after-free vuln, since
those already-open handles haven't been released yet.

And since release() free memory too, race to use-after-free and
double-free vuln occur.

To prevent this, if device is registered from probe(), it should be
modified to free memory only through release() rather than calling
kfree() directly.

Cc: <stable@vger.kernel.org>
Reported-by: syzbot+6ffd76b5405c006a46b7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6ffd76b5405c006a46b7
Reported-by: syzbot+f1b20958f93d2d250727@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f1b20958f93d2d250727
Fixes: 8bc4a9ed85 ("[media] hackrf: add support for transmitter")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:18 +01:00
Paolo Abeni
a2efb1b80f Merge branch 'net-dsa-mv88e6xxx-add-partial-support-for-tcam-entries'
Cedric Jehasse says:

====================
net: dsa: mv88e6xxx: Add partial support for TCAM entries

This series adds partial Ternary Content Addressable Memory (TCAM) for
the mv88e6390 and mv88e6393 family of switches. TCAM entries allow the
switch to match the first 48 or 96 bytes of a frame and take actions on
matched frames.

This patch introduces a subset of the available TCAM functionality.
Matching on ip addresses/protocol and trapping to the cpu.

Eg. to trap traffic with destination ip 224.0.1.129 to the cpu:

tc qdisc add dev p1 clsact
tc filter add dev p1 ingress protocol ip flower skip_sw \
    dst_ip 224.0.1.129 action trap

Review of the mv88e6xxx changes have brought to light something in
cls_flower:
When adding a classifier with an ipv4 address both
FLOW_DISSECTOR_KEY_IPV4_ADDRS and FLOW_DISSECTOR_KEY_IPV6_ADDRS bits are
set in dissector->used_keys.
A change was made to address this.

Signed-off-by: Cedric Jehasse <cedric.jehasse@luminex.be>
====================

Link: https://patch.msgid.link/20260311-net-next-mv88e6xxx-tcam-v8-0-32dd5ba30002@luminex.be
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-17 10:35:22 +01:00
Cedric Jehasse
639f1dcfde net: dsa: mv88e6xxx: Add partial support for TCAM entries
This patch adds partial Ternary Content Addressable Memory (TCAM) for
the mv88e6390 and mv88e6393 family of switches. TCAM entries allow the
switch to match the first 48 or 96 bytes of a frame and take actions on
matched frames.

This patch introduces a subset of the available TCAM functionality.
Matching on ip addresses/protocol and trapping to the cpu.

Eg. to trap traffic with destination ip 224.0.1.129 to the cpu:

tc qdisc add dev p1 clsact
tc filter add dev p1 ingress protocol ip flower skip_sw \
    dst_ip 224.0.1.129 action trap

Signed-off-by: Cedric Jehasse <cedric.jehasse@luminex.be>
Link: https://patch.msgid.link/20260311-net-next-mv88e6xxx-tcam-v8-2-32dd5ba30002@luminex.be
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-17 10:35:20 +01:00
Cedric Jehasse
b513dde96c net/sched: cls_flower: remove unions from fl_flow_key
When creating a flower classifier with an ipv4 address the
flow_dissector has both FLOW_DISSECTOR_KEY_IPV4_ADDRS and
FLOW_DISSECTOR_KEY_IPV6_ADDRS bits set in used_keys.
This happens because ipv4/ipv6 fields are a union and
FL_KEY_SET_IF_MASKED() will interpret either being set as both.

Removing the unions fixes this behavior without needing special handling
for union fields.

Example of a command that caused FLOW_DISSECTOR_KEY_IPV4_ADDRS and
FLOW_DISSECTOR_KEY_IPV6_ADDRS to be set:
tc filter add dev p1 ingress protocol ip flower skip_sw \
    dst_ip 224.0.1.129 action trap

Signed-off-by: Cedric Jehasse <cedric.jehasse@luminex.be>
Link: https://patch.msgid.link/20260311-net-next-mv88e6xxx-tcam-v8-1-32dd5ba30002@luminex.be
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-17 10:35:20 +01:00
Rosen Penev
b800359a4d mtd: cmdlinepart: use a flexible array member
This is already allocated properly. It's just using an extra pointer.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-17 10:28:14 +01:00
Jonathan Cavitt
1cabff0d18 drm/i915/gvt: Swap read and write checks
The function intel_gvt_i2c_handle_aux_ch_write currently does not
support the DP_AUX_I2C_WRITE operation.  Notably, we check if
op & 0x1 == DP_AUX_I2C_WRITE (one), and if it does not, assert that
op & 0x1 == DP_AUX_I2C_READ (zero).  This is unnecessary because if
op & 0x1 != 1, then op & 0x1 == 0.  But beyond that, it probably makes
more sense to check for the condition that is implemented, rather than
check for the condition that is not.

Swap the conditions.  We can also get rid of the unnecessary drm_WARN_ON
while we're here.

Suggested-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patch.msgid.link/20260204161945.8127-2-jonathan.cavitt@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-17 11:27:14 +02:00
Jonathan Cavitt
33978364a2 drm/i915/display: PORT_NONE is not valid
Static analysis issue:

In assert_port_valid, add a check to ensure port != PORT_NONE, as that
is not a valid port.  The check must be explicit to prevent a bad bit
shift operation in the general case via short-circuiting.  It's not
likely this will ever come up in a real use case, but it's at least
worth guarding against.

It would probably also be pertinent to modify the behavior of the
port_name function to correctly print PORT_NONE in this case, as
currently the port would be reported as 'port @' by the debugger.  But
that should be done separately, and given port_name is mostly just a
debug printing helper function anyways, fixing it is a low priority.

v2:
- Conditional check was backwards.  Fix it.  (Jani)

Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patch.msgid.link/20260123152121.7042-2-jonathan.cavitt@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-17 11:19:11 +02:00
Jouni Högander
7caac659a8 drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state
PSR entry_setup_frames is currently computed directly into struct
intel_dp:intel_psr:entry_setup_frames. This causes a problem if mode change
gets rejected after PSR compute config: Psr_entry_setup_frames computed for
this rejected state is in intel_dp:intel_psr:entry_setup_frame. Fix this by
computing it into intel_crtc_state and copy the value into
intel_dp:intel_psr:entry_setup_frames on PSR enable.

Fixes: 2b981d57e4 ("drm/i915/display: Support PSR entry VSC packet to be transmitted one frame earlier")
Cc: Mika Kahola <mika.kahola@intel.com>
Cc: <stable@vger.kernel.org> # v6.8+
Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Link: https://patch.msgid.link/20260312083710.1593781-3-jouni.hogander@intel.com
(cherry picked from commit 8c229b4aa0)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-03-17 11:17:46 +02:00
Jouni Högander
b0a4dba7b6 drm/i915/psr: Disable PSR on update_m_n and update_lrr
PSR/PR parameters might change based on update_m_n or update_lrr. Disable
on update_m_n and update_lrr to ensure proper parameters are taken into use
on next PSR enable in intel_psr_post_plane_update.

Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15771
Fixes: 2bc98c6f97 ("drm/i915/alpm: Compute ALPM parameters into crtc_state->alpm_state")
Cc: <stable@vger.kernel.org> # v6.19+
Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Link: https://patch.msgid.link/20260312083710.1593781-2-jouni.hogander@intel.com
(cherry picked from commit 65852b56bf)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-03-17 11:17:43 +02:00
Arnd Bergmann
8510d054b7 KVM: arm64: avoid unused-variable warning
The 'cpu' variable is only used inside of an #ifdef block and causes
a warning if there is no user:

arch/arm64/kvm/hyp_trace.c: In function 'kvm_hyp_trace_init':
arch/arm64/kvm/hyp_trace.c:422:13: error: unused variable 'cpu' [-Werror=unused-variable]
  422 |         int cpu;
      |             ^~~

Change the #ifdef to an equivalent IS_ENABLED() check to avoid
the warning.

Fixes: b22888917f ("KVM: arm64: Sync boot clock with the nVHE/pKVM hyp")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Link: https://patch.msgid.link/20260313094925.3749287-1-arnd@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-17 09:16:35 +00:00
Vincent Donnefort
1211907ac0 tracing: Generate undef symbols allowlist for simple_ring_buffer
Compiler and tooling-generated symbols are difficult to maintain
across all supported architectures. Make the allowlist more robust by
replacing the harcoded list with a mechanism that automatically detects
these symbols.

This mechanism generates a C function designed to trigger common
compiler-inserted symbols.

Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Tested-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260316092845.3367411-1-vdonnefort@google.com
[maz: added __msan prefix to allowlist as pointed out by Arnd]
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-17 09:01:19 +00:00
Alexey Nepomnyashih
bb120ad57d ALSA: firewire-lib: fix uninitialized local variable
Similar to commit d8dc872046 ("ALSA: firewire-lib: fix uninitialized
local variable"), the local variable `curr_cycle_time` in
process_rx_packets() is declared without initialization.

When the tracepoint event is not probed, the variable may appear to be
used without being initialized. In practice the value is only relevant
when the tracepoint is enabled, however initializing it avoids potential
use of an uninitialized value and improves code safety.

Initialize `curr_cycle_time` to zero.

Fixes: fef4e61b0b ("ALSA: firewire-lib: extend tracepoints event including CYCLE_TIME of 1394 OHCI")
Cc: stable@vger.kernel.org
Signed-off-by: Alexey Nepomnyashih <sdl@nppct.ru>
Link: https://patch.msgid.link/20260316191824.83249-1-sdl@nppct.ru
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-03-17 09:54:48 +01:00
Faruque Ansari
d6f8e0e06d cpufreq: Add QCS8300 to cpufreq-dt-platdev blocklist
The Qualcomm QCS8300 platform uses the qcom-cpufreq-hw
driver, so add it to the cpufreq-dt-platdev driver's blocklist.

Signed-off-by: Faruque Ansari <faruque.ansari@oss.qualcomm.com>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-03-17 14:21:32 +05:30
Krzysztof Kozlowski
ffe6989c73 Fixing a missing of_node_put() call.
-----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCAAuFiEE7v+35S2Q1vLNA3Lx86Z5yZzRHYEFAmm1pkYQHGhlaWtvQHNu
 dGVjaC5kZQAKCRDzpnnJnNEdgQ88B/9uifMASMAlfEb3/Bdf64ek/Lj3Dy+HH0BC
 wNgoU6PVDtJCbbQ1OXDHgUorq5Y0jD9OhTAuXPlvohfOsoM9ImezJqDqJknApqar
 TbezcMSU0n6I8x5Ag9v8zFNEGHStYZCwWVeEoHMiVdxcLbHn2ao9WhF+ciTtpvkw
 xmGB+fcBh4re79fHiN+h++wcgMD3coLcM2biT+m6izVZk5OHIxL+OQHEt8uqGh8I
 FzcYrmfV87eR6hBSzB+5jYPeuBfMaXZy331xLHIBzCsqOheofh+IyALu2bacbPdo
 kYPvRk0VpLhBJVepiw9rqgxsTRH4SKDzKY+bEN1osUKFBnbLfCbx
 =p3ca
 -----END PGP SIGNATURE-----

Merge tag 'v7.0-rockchip-drvfixes1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes

Fixing a missing of_node_put() call.

* tag 'v7.0-rockchip-drvfixes1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip:
  soc: rockchip: grf: Add missing of_node_put() when returning

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-03-17 09:35:40 +01:00
Krzysztof Kozlowski
d9ef8c91c4 Renesas DTS updates for v7.1
- Add CPU frequency scaling and QSPI NOR FLASH support on the RZ/N1
     SoC and the RZN1D-DB development board,
   - Add PCIe slot power control on the R-Car H3, M3-W(+), M3-N, and E3
     SoCs,
   - Add USB3.0 PHY support on the R-Car E3 SoC and the Ebisu development
     board,
   - Add PCIe/USB3.0 clock generator support on the Salvator-X(S), ULCB
     King Fisher extension, and Ebisu development boards,
   - Add RTC support on the RZ/V2N SoC and its EVK board,
   - Add SPI DMA support on the RZ/T2H, RZ/N2H, RZ/V2H(P), and RZ/V2N
     SoCs,
   - Add support for the second SDHI channel on the Atmark Techno
     Armadillo-800-EVA board,
   - Miscellaneous fixes and improvements.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCabPoqgAKCRCKwlD9ZEnx
 cK3VAP9KtqAaL0emRTRxXYXoiuovuOmJItILVV+x5SCGMcEsVQEAjdLhn6qOpQ7E
 RZAUp488yi3FFjihA66ueFTag7uXFw4=
 =VlnU
 -----END PGP SIGNATURE-----

Merge tag 'renesas-dts-for-v7.1-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt

Renesas DTS updates for v7.1

  - Add CPU frequency scaling and QSPI NOR FLASH support on the RZ/N1
    SoC and the RZN1D-DB development board,
  - Add PCIe slot power control on the R-Car H3, M3-W(+), M3-N, and E3
    SoCs,
  - Add USB3.0 PHY support on the R-Car E3 SoC and the Ebisu development
    board,
  - Add PCIe/USB3.0 clock generator support on the Salvator-X(S), ULCB
    King Fisher extension, and Ebisu development boards,
  - Add RTC support on the RZ/V2N SoC and its EVK board,
  - Add SPI DMA support on the RZ/T2H, RZ/N2H, RZ/V2H(P), and RZ/V2N
    SoCs,
  - Add support for the second SDHI channel on the Atmark Techno
    Armadillo-800-EVA board,
  - Miscellaneous fixes and improvements.

* tag 'renesas-dts-for-v7.1-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: (30 commits)
  ARM: dts: renesas: armadillo800eva: Add wakeup-source to st1232
  ARM: dts: renesas: armadillo800eva: Enable SDHI1
  ARM: dts: renesas: r9a06g032-rzn1d400-db: Use interrupts for Micrel PHYs
  ARM: dts: renesas: r9a06g032-rzn1d400-db: Do not use underscores in node names
  ARM: dts: renesas: r9a06g032-rzn1d400-db: Add QSPI node including NOR flash
  arm64: dts: renesas: r9a09g057: Add DMA support for RSPI channels
  arm64: dts: renesas: r9a09g056: Add DMA support for RSPI channels
  ARM: dts: renesas: r9a06g032: Describe the QSPI controller
  arm64: dts: renesas: r9a09g087: Wire up DMA support for SPI
  arm64: dts: renesas: r9a09g077: Wire up DMA support for SPI
  arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable RTC
  arm64: dts: renesas: r9a09g056: Add RTC node
  arm64: dts: renesas: ebisu: Describe PCIe/USB3.0 clock generator
  arm64: dts: renesas: ulcb: ulcb-kf: Describe PCIe/USB3.0 clock generator
  arm64: dts: renesas: salvator-common: Describe PCIe/USB3.0 clock generator
  arm64: dts: renesas: r8a77990: Add USB 3.0 PHY and USB3S0 clock nodes
  arm64: dts: renesas: r8a77990: Describe PCIe root port
  arm64: dts: renesas: r8a77965: Describe PCIe root ports
  arm64: dts: renesas: r8a77961: Describe PCIe root ports
  arm64: dts: renesas: r8a77960: Describe PCIe root ports
  ...

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-03-17 09:27:44 +01:00
Ritesh Harjani (IBM)
07791ff060 powerpc: Print MMU_FTRS_POSSIBLE & MMU_FTRS_ALWAYS at startup
Similar to CPU_FTRS_[POSSIBLE|ALWAYS], let's also print
MMU_FTRS_[POSSIBLE|ALWAYS]. This has some useful data to capture during
bootup.

Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/c37a9f314a723048d25aa5424f7ede8eec691d86.1773078178.git.ritesh.list@gmail.com
2026-03-17 13:56:37 +05:30
Ritesh Harjani (IBM)
24eb637840 powerpc/64s: Make use of H_RPTI_TYPE_ALL macro
Instead of opencoding, let's use the pre-defined macro (H_RPTI_TYPE_ALL)
at the following places.

Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/d1d32404d5f0d3e93cd0faad2298b7bfed31288f.1773078178.git.ritesh.list@gmail.com
2026-03-17 13:56:37 +05:30
Ritesh Harjani (IBM)
f074059c7a powerpc/64s: Rename tlbie_lpid_va to tlbie_va_lpid
In previous patch we renamed tlbie_va_lpid functions to
tlbie_va_pid_lpid() since those were working with PIDs as well.
This then allows us to rename tlbie_lpid_va to tlbie_va_lpid, which
finally makes all the tlbie function naming consistent.

No functional change in this patch.

Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/8fadd2beb2f883c65ba0d797c87d238098cd13c8.1773078178.git.ritesh.list@gmail.com
2026-03-17 13:56:37 +05:30
Ritesh Harjani (IBM)
7bcfba20e9 powerpc/64s: Rename tlbie_va_lpid to tlbie_va_pid_lpid
It only make sense to rename these functions, so it's better reflect what
they are supposed to do. For e.g. __tlbie_va_pid_lpid name better reflect
that it is invalidating tlbie using VA, PID and LPID.

No functional change in this patch.

Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/0a0b2cf23b9522f891f9a0f976bbdc5c8e6f6d8b.1773078178.git.ritesh.list@gmail.com
2026-03-17 13:56:37 +05:30
Ritesh Harjani (IBM)
4894e2fb7b powerpc/64s: Kill the unused argument of exit_lazy_flush_tlb
In previous patch we removed the only caller of exit_lazy_flush_tlb()
which was passing always_flush = false in it's second argument.

With that gone, all the callers of exit_lazy_flush_tlb() are local to
radix_pgtable.c and there is no need of an additional argument.

This patch does the required cleanup. There should not be any
functionality change in this patch.

Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/6f96ea53588034312ae84f74b1e2fa9c4ce7cfd5.1773078178.git.ritesh.list@gmail.com
2026-03-17 13:56:37 +05:30
Ritesh Harjani (IBM)
bf7c1497d2 powerpc/64s: Move serialize_against_pte_lookup() to hash_pgtable.c
Originally,
commit fa4531f753 ("powerpc/mm: Don't send IPI to all cpus on THP updates")
introduced serialize_against_pte_lookup() call for both Radix and Hash.

However below commit fixed the race with Radix
commit 70cbc3cc78 ("mm: gup: fix the fast GUP race against THP collapse")

And therefore following commit removed the
serialize_against_pte_lookup() call from radix_pgtable.c
commit bedf034169
("powerpc/64s/radix: don't need to broadcast IPI for radix pmd collapse flush")

Now since serialize_against_pte_lookup() only gets called from
hash__pmdp_collapse_flush(), thus move the related functions to
hash_pgtable.c

Hence this patch:
- moves serialize_against_pte_lookup() from radix_pgtable.c to hash_pgtable.c
- removes the radix specific calls from do_serialize()
- renames do_serialize() to do_nothing().

There should not be any functionality change in this patch.

Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/a73ebe800a9be257329507703779f822363f8b2f.1773078178.git.ritesh.list@gmail.com
2026-03-17 13:56:37 +05:30
Ritesh Harjani (IBM)
4a342f3e6f powerpc/64s/tlbflush-radix: Remove unused radix__flush_tlb_pwc()
Commit 52162ec784
("powerpc/mm/book3s64/radix: Use freed_tables instead of need_flush_all")
removed radix__flush_tlb_pwc() definition, but missed to remove the extern
declaration. This patch removes it.

Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/b79c8ce8f00aa3e96ab9b1c77bc004759c397d3f.1773078178.git.ritesh.list@gmail.com
2026-03-17 13:56:37 +05:30