Commit graph

1,461,726 commits

Author SHA1 Message Date
Stanislav Kinsburskii
c527c7aee2 mshv: Always map child vp stats pages regardless of scheduler type
Currently vp->vp_stats_pages is only used by the root scheduler for fast
interrupt injection.

Soon, vp_stats_pages will also be needed for exposing child VP stats to
userspace via debugfs. Mapping the pages a second time to a different
address causes an error on L1VH.

Remove the scheduler requirement and always map the vp stats pages.

Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Signed-off-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
Acked-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-02-04 06:17:05 +00:00
Stanislav Kinsburskii
1ba923d8cd mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h
These functions are currently only used to map child partition VP stats,
on root partition. However, they will soon be used on L1VH, and also
used for mapping the host's own VP stats.

Introduce a helper is_l1vh_parent() to determine whether we are mapping
our own VP stats. In this case, do not attempt to map the PARENT area.
Note this is a different case than mapping PARENT on an older hypervisor
where it is not available at all, so must be handled separately.

On unmap, pass the stats pages since on L1VH the kernel allocates them
and they must be freed in hv_unmap_stats_page().

Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Signed-off-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
Acked-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-02-04 06:17:05 +00:00
Stanislav Kinsburskii
2de4516aa8 mshv: Use typed hv_stats_page pointers
Refactor all relevant functions to use struct hv_stats_page pointers
instead of void pointers for stats page mapping and unmapping thus
improving type safety and code clarity across the Hyper-V stats mapping
APIs.

Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Signed-off-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
Acked-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-02-04 06:17:05 +00:00
Purna Pavan Chandra Aekkaladevi
7538b80e5a mshv: Ignore second stats page map result failure
Older versions of the hypervisor do not have a concept of separate SELF
and PARENT stats areas. In this case, mapping the HV_STATS_AREA_SELF page
is sufficient - it's the only page and it contains all available stats.

Mapping HV_STATS_AREA_PARENT returns HV_STATUS_INVALID_PARAMETER which
currently causes module init to fail on older hypevisor versions.

Detect this case and gracefully fall back to populating
stats_pages[HV_STATS_AREA_PARENT] with the already-mapped SELF page.

Add comments to clarify the behavior, including a clarification of why
this isn't needed for hv_call_map_stats_page2() which always supports
PARENT and SELF areas.

Signed-off-by: Purna Pavan Chandra Aekkaladevi <paekkaladevi@linux.microsoft.com>
Signed-off-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
Reviewed-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Acked-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-02-04 06:17:05 +00:00
Michael Kelley
8d1294d4b5 mshv: Use EPOLLIN and EPOLLHUP instead of POLLIN and POLLHUP
mshv code currently uses the POLLIN and POLLHUP flags. Starting with
commit a9a08845e9 ("vfs: do bulk POLL* -> EPOLL* replacement") the
intent is to use the EPOLL* versions throughout the kernel.

The comment at the top of mshv_eventfd.c describes it as being inspired
by the KVM implementation, which was changed by the above mentioned
commit in 2018 to use EPOLL*. mshv_eventfd.c is much newer than 2018
and there's no statement as to why it must use the POLL* versions.
So change it to use the EPOLL* versions. This change also resolves
a 'sparse' warning.

No functional change, and the generated code is the same.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202601220948.MUTO60W4-lkp@intel.com/
Signed-off-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-02-04 06:16:04 +00:00
Mukesh R
956efd32f9 x86/hyperv: fix a compiler warning in hv_crash.c
Fix a compiler warning that status is defined by not used.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202512301641.FC6OAbGM-lkp@intel.com/
Signed-off-by: Mukesh R <mrathor@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-02-04 06:11:38 +00:00
Michael Kelley
754cf84504 mshv: Fix compiler warning about cast converting incompatible function type
In mshv_vtl_sint_ioctl_pause_msg_stream(), the reference to function
mshv_vtl_synic_mask_vmbus_sint() is cast to type smp_call_func_t. The
cast generates a compiler warning because the function signature of
mshv_vtl_synic_mask_vmbus_sint() doesn't match smp_call_func_t.

There's no actual bug here because the mis-matched function signatures
are compatible at runtime. Nonetheless, eliminate the compiler warning
by changing the function signature of mshv_vtl_synic_mask_vmbus_sint()
to match what on_each_cpu() expects. Remove the cast because it is then
no longer necessary.

No functional change.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202601170352.qbh3EKH5-lkp@intel.com/
Signed-off-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-02-04 06:08:05 +00:00
Michael Kelley
90fb0a25f6 PCI: hv: Remove unused field pci_bus in struct hv_pcibus_device
Field pci_bus in struct hv_pcibus_device is unused since
commit 418cb6c8e0 ("PCI: hv: Generify PCI probing"). Remove it.

No functional change.

Signed-off-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Easwar Hariharan <easwar.hariharan@linux.microsoft.com>
Reviewed-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com>
Reviewed-by: Srivatsa S. Bhat (Microsoft) <srivatsa@csail.mit.edu>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-02-04 05:59:51 +00:00
Stephen Boyd
7fbabe8f07 Qualcomm clock updates for v6.20
Convert clock dividers from round_rate() to determine_rate().
 
 Add support for global, tcsr, rpmh, display, gpu, camera, and video
 clock controllers for Kaanapali.
 
 Add support for camera clock controller for SM8750.
 
 Fix the SDCC RCGs to use shared_floor_ops across a variety of platforms.
 
 Add support for global clock controller on MSM8940 and SDM439.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmmCLSQACgkQCx85Pw2Z
 rcXvsBAAqetEosqax7FaM1MvrHenDwSblabnx4dwbBB2M9Jfuphq34pBAZujylet
 YHQdrcLON/9mhsOnqbvxZN8DvzfwcgkKEygUf/JLvQe3DwHJ/pi8W6mnjcNLRzMw
 DFiK87/ufNs3oEAWJv59248CixaRb/XpHRGov6dw9fCSCHVVWpixyD+9Xmgt5f1U
 W5xRN6PYH8wdlBtvzdSybjPyEpcqUjllQAP4V2mpzWMNzsjPrQMQZWfjvPg1s13l
 ADsXMTxR8sr9vsRKFgI7WDHvaDvpj3WPpVK6EIys52vNdxs1vG8jZGyxxZGTlTdB
 dVHqExcEYRA1Q0dUL5Fs2AFJ5FuU6m8Y/mtOYlygz84oKX4MU5TglEgS4W9PgtAc
 +7+5L98mXTxILYnujBlSaM2Pule7/bj4KV9iZeELjhCgIUP50XluJ2hOsMHsnChI
 VTzaFrm81n0MA0SwMazDNRZZjKVgSg7O4kfVRDlFVXkql0HHg4Bpp2Oz9V6eBB1m
 y/Ely5bMBB6ao0rfbt7+VwCnNN5kBIJzIF66onneEfSp+vlDX9nUdcdUMc14+k/S
 76s1ZNTBvPqyY9fgRDYA1GtR78l99zwT3zewKEjQgmqa5jq2h6zwPaMTgBQrMDpD
 iixg5jXZdjdvfE6iB9kyiT1OD2px/6PFYywrJ/yUgrMamHjRb58=
 =8hvs
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmmC3FMUHHN3Ym95ZEBj
 aHJvbWl1bS5vcmcACgkQrQKIl8bklSUUhg/+JY7k+pxrQ4jLrVzfMuH5qLkDfHmI
 ZAQd73lLqvkA9W9RvJwRCZe1RytiWkR1Nv/ktvjE+aXWKQnwq4AOCIOaQGG5OLj7
 x2M7mC+YjDy+LwSgUfitKV+sAvR4i8SMmZlOs366Ur96vA0r6fb6jgEOsYqsppay
 JQTISs2Ykigz3inWSTA6FlteHJ8eI7KGpmrOAJWJlGCXWMD6jUpKd7CEtJBLuKud
 ql21qQ+zH+RnD5bcow6xi1noPx8SWTX5t3u8q1Afmi+tcz90XhfCV+ooz+lHhFef
 ytw2rduE4dg0/GYYA5JSRYDuq+QfK+l/HZUbAfKRlZs4Fns3Y0EhaCiO/GLDdFcH
 gnbVU/ToqupZ5O/2EHl6HlKGuZeoD3HjxJj+T+zWJIQVs5esqOp9uOGisPETK4Zm
 H0SQSNg1BJQ0rTahP9VqQp2NZ47lWnlQhOZPzJeBETGFldGy8hvcgIuwCXCBMvHc
 veuupb3Zbxt9kU7mjgcPfcRW0AS/o3zDuADkzKaNIfKE0IlvYjZhrFoi5/A4JfTw
 AIE5WaD+OEs60b2sA5bQh+ZEK0BFl3/CIO9hYFHvRDMhG7qMFWuopB59SG7Efn6L
 lXdLUV16nPG4zN7yIimf1UzAdK12fO1xAWQZS6zzB8JDc54A7ZG5+O2Z0BuPcZ/H
 UQ0T4U8x9rDdkeg=
 =U3q+
 -----END PGP SIGNATURE-----

Merge tag 'qcom-clk-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom

Pull Qualcomm clk driver updates from Bjorn Andersson:

 - Convert clock dividers from round_rate() to determine_rate()
 - Add support for global, tcsr, rpmh, display, gpu, camera, and
   video clock controllers for Kaanapali
 - Add support for camera clock controller for SM8750
 - Fix the SDCC RCGs to use shared_floor_ops across a variety of
   platforms
 - Add support for global clock controller on MSM8940 and SDM439

* tag 'qcom-clk-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (49 commits)
  clk: qcom: sm8750: Constify 'qcom_cc_desc' in SM8750 camcc
  clk: qcom: gfx3d: add parent to parent request map
  clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src
  clk: qcom: dispcc-sdm845: Enable parents for pixel clocks
  clk: qcom: regmap-divider: convert from divider_round_rate() to divider_determine_rate()
  clk: qcom: regmap-divider: convert from divider_ro_round_rate() to divider_ro_determine_rate()
  clk: qcom: alpha-pll: convert from divider_round_rate() to divider_determine_rate()
  clk: qcom: Add support for GPUCC and GXCLK for Kaanapali
  clk: qcom: Add support for VideoCC driver for Kaanapali
  clk: qcom: camcc: Add support for camera clock controller for Kaanapali
  clk: qcom: dispcc: Add support for display clock controller Kaanapali
  clk: qcom: clk-alpha-pll: Add support for controlling Pongo EKO_T PLL
  clk: qcom: clk-alpha-pll: Update the PLL support for cal_l
  clk: qcom: camcc: Add camera clock controller driver for SM8750 SoC
  clk: qcom: clk-alpha-pll: Add support for controlling Rivian PLL
  dt-bindings: clock: qcom: document the Kaanapali GPU Clock Controller
  dt-bindings: clock: qcom: Add Kaanapali video clock controller
  dt-bindings: clock: qcom: Add support for CAMCC for Kaanapali
  dt-bindings: clock: qcom: document Kaanapali DISPCC clock controller
  dt-bindings: clock: qcom: Add camera clock controller for SM8750 SoC
  ...
2026-02-03 21:41:51 -08:00
Jammy Huang
5f35b48a0d
clk: aspeed: Add reset for HACE/VIDEO
Add mappings of reset per hw's definition.

Signed-off-by: Jammy Huang <jammy_huang@aspeedtech.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-02-03 21:37:07 -08:00
Jammy Huang
2ad2d0e291
dt-bindings: clock: aspeed: Add VIDEO reset definition
ASPEED clock controller provides a couple of resets. Add the define of
video to allow referring to it.

Signed-off-by: Jammy Huang <jammy_huang@aspeedtech.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-02-03 21:37:05 -08:00
Ryan Chen
fdc1eb624d
clk: aspeed: add AST2700 clock driver
Add AST2700 clock controller driver and also use axiliary
device framework register the reset controller driver.
Due to clock and reset using the same register region.

Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-02-03 21:36:00 -08:00
Ryan Chen
122c157c48
MAINTAINERS: Add entry for ASPEED clock drivers.
Add support entry for ASPEED clock drivers.

Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-02-03 21:35:59 -08:00
Ryan Chen
03b3faa12c
clk: aspeed: Move the existing ASPEED clk drivers into aspeed subdirectory.
Prepare for long-term maintenance and future additions by introducing a
dedicated drivers/clk/aspeed/ subdirectory for ASPEED clock drivers.

Move the existing ASPEED clock drivers into the new
drivers/clk/aspeed/ subdirectory.

No functional change, file move only.

Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-02-03 21:35:58 -08:00
Stephen Boyd
448b50b5cf
Revert "clk: Respect CLK_OPS_PARENT_ENABLE during recalc"
This reverts commit 669917676e.
It's been shown to cause problems on i.MX and STM32 platforms
where the board doesn't boot. In one case, a clk with
CLK_IS_CRITICAL and CLK_OPS_PARENT_ENABLE is being registered
causing the parent to be enabled, the rate recalculated, and then
the parent is disabled causing the critical clk being registered
to stop clocking.

A fix for that would be to calculate the rate of the clk after
enabling the critical clk itself, but that wouldn't fix another
problem where a clk with CLK_OPS_PARENT_ENABLE is registered
before the parent is registered. In this case the hardware access
in the clk_ops::recalc_rate() function would fail if the parent
is disabled.

There are even more problems exposed by this patch because it
introduces logic that disables clks earlier in system boot than
has existed previously. Historically we've not disabled clks
until late init (clk_disable_unused) under the assumption that
clks have been registered enough to have a consistent view of the
clk tree. The clk_disable_unused logic doesn't work very well
though, leading to quite a few devices booting with
clk_ignore_unused on the kernel command line.

Long story short, disabling clks during clk registration is full
of pitfalls. Revert this commit until a proper solution can be
found.

Reported-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Closes: https://lore.kernel.org/r/6239343.lOV4Wx5bFT@steina-w
Reported-by: Mark Brown <broonie@kernel.org>
Closes: https://lore.kernel.org/r/036da7ce-6487-4a6e-9b15-97c6d3bcdcec@sirena.org.uk
Cc: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Cc: Brian Masney <bmasney@redhat.com>
Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Cc: Chen-Yu Tsai <wenst@chromium.org>
Tested-by: Peng Fan <peng.fan@nxp.com>
Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Tested-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-02-03 21:28:18 -08:00
Gwendal Grignou
520e345dfd platform/chrome: lightbar: Use flexible array member
Variable arrays should be defined as [], not [0], otherwise
the kernel complains:

memcpy  : detected field-spanning write (size 9) of single field "param->set_program_ex.data" at drivers/platform/chrome/cros_ec_lightbar.c:603 (size 0)

Fixes: 9600b8bdbf ("platform/chrome: lightbar: Add support for large sequence")
Signed-off-by: Gwendal Grignou <gwendal@google.com>
Link: https://lore.kernel.org/r/20260204034848.697033-1-gwendal@google.com
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
2026-02-04 04:38:13 +00:00
Jakub Kicinski
7576bd9017 Merge branch 'net-cpsw-execute-ndo_set_rx_mode-callback-in-a-work-queue'
Kevin Hao says:

====================
net: cpsw: Execute ndo_set_rx_mode callback in a work queue

These two patches resolve an RTNL assertion call trace issue
in both the legacy and new cpsw drivers.
====================

Link: https://patch.msgid.link/20260203-bbb-v5-0-ea0ea217a85c@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:45:54 -08:00
Kevin Hao
0b8c878d11 net: cpsw: Execute ndo_set_rx_mode callback in a work queue
Commit 1767bb2d47 ("ipv6: mcast: Don't hold RTNL for
IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL lock for
IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this
change triggered the following call trace on my BeagleBone Black board:
  WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/481
  RTNL: assertion failed at net/8021q/vlan_core.c (236)
  Modules linked in:
  CPU: 0 UID: 997 PID: 481 Comm: rpcbind Not tainted 6.19.0-rc7-next-20260130-yocto-standard+ #35 PREEMPT
  Hardware name: Generic AM33XX (Flattened Device Tree)
  Call trace:
   unwind_backtrace from show_stack+0x28/0x2c
   show_stack from dump_stack_lvl+0x30/0x38
   dump_stack_lvl from __warn+0xb8/0x11c
   __warn from warn_slowpath_fmt+0x130/0x194
   warn_slowpath_fmt from vlan_for_each+0x120/0x124
   vlan_for_each from cpsw_add_mc_addr+0x54/0x98
   cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec
   __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88
   __dev_mc_add from igmp6_group_added+0x84/0xec
   igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0
   __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4
   __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168
   do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8
   ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c
   do_sock_setsockopt from __sys_setsockopt+0x84/0xac
   __sys_setsockopt from ret_fast_syscall+0x0/0x54

This trace occurs because vlan_for_each() is called within
cpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held.
Since modifying vlan_for_each() to operate without the RTNL lock is not
straightforward, and because ndo_set_rx_mode() is invoked both with and
without the RTNL lock across different code paths, simply adding
rtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution.

To resolve this issue, we opt to execute the actual processing within
a work queue, following the approach used by the icssg-prueth driver.

Please note: To reproduce this issue, I manually reverted the changes to
am335x-bone-common.dtsi from commit c477358e66 ("ARM: dts: am335x-bone:
switch to new cpsw switch drv") in order to revert to the legacy cpsw
driver.

Fixes: 1767bb2d47 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.")
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260203-bbb-v5-2-ea0ea217a85c@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:45:52 -08:00
Kevin Hao
c0b5dc73a3 net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue
Commit 1767bb2d47 ("ipv6: mcast: Don't hold RTNL for
IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL lock for
IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this
change triggered the following call trace on my BeagleBone Black board:
  WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/496
  RTNL: assertion failed at net/8021q/vlan_core.c (236)
  Modules linked in:
  CPU: 0 UID: 997 PID: 496 Comm: rpcbind Not tainted 6.19.0-rc6-next-20260122-yocto-standard+ #8 PREEMPT
  Hardware name: Generic AM33XX (Flattened Device Tree)
  Call trace:
   unwind_backtrace from show_stack+0x28/0x2c
   show_stack from dump_stack_lvl+0x30/0x38
   dump_stack_lvl from __warn+0xb8/0x11c
   __warn from warn_slowpath_fmt+0x130/0x194
   warn_slowpath_fmt from vlan_for_each+0x120/0x124
   vlan_for_each from cpsw_add_mc_addr+0x54/0xd8
   cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec
   __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88
   __dev_mc_add from igmp6_group_added+0x84/0xec
   igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0
   __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4
   __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168
   do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8
   ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c
   do_sock_setsockopt from __sys_setsockopt+0x84/0xac
   __sys_setsockopt from ret_fast_syscall+0x0/0x5

This trace occurs because vlan_for_each() is called within
cpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held.
Since modifying vlan_for_each() to operate without the RTNL lock is not
straightforward, and because ndo_set_rx_mode() is invoked both with and
without the RTNL lock across different code paths, simply adding
rtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution.

To resolve this issue, we opt to execute the actual processing within
a work queue, following the approach used by the icssg-prueth driver.

Fixes: 1767bb2d47 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.")
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260203-bbb-v5-1-ea0ea217a85c@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:45:52 -08:00
Ethan Nelson-Moore
9a9424c756 net: usb: sr9700: remove code to drive nonexistent multicast filter
Several registers referenced in this driver's source code do not
actually exist (they are not writable and read as zero in my testing).
They exist in this driver because it originated as a copy of the dm9601
driver. Notably, these include the multicast filter registers - this
causes the driver to not support multicast packets correctly. Remove
the multicast filter code and register definitions. Instead, set the
chip to receive all multicast filter packets when any multicast
addresses are in the list.

Reviewed-by: Simon Horman <horms@kernel.org> (from v1)
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:42:15 -08:00
Ethan Nelson-Moore
61e94cbdf8 net: usb: introduce usbnet_mii_ioctl helper function
Many USB network drivers use identical code to pass ioctl
requests on to the MII layer. Reduce code duplication by
refactoring this code into a helper function.

Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> (v1)
Reviewed-by: Andrew Lunn <andrew@lunn.ch> (v3)
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260203013517.26170-1-enelsonmoore@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:41:19 -08:00
Jakub Kicinski
e9a1a28af9 Merge branch 'net-ethernet-renesas-rcar_gen4_ptp-hide-private-data'
Niklas Söderlund says:

====================
net: ethernet: renesas: rcar_gen4_ptp: Hide private data

The R-Car Gen4 PTP module started out as an exclusive feature of a
single driver, but have since been extended to cover both R-Car Switch
and TSN driver implementations on Gen4.

The feature have already been extended to be built as its own module
with an interface exposed thru a local header file. The header file
however also exposes the modules private data structure. The two
existing users have already started to poke at members of the struct.

The exposed private data being manipulated by users makes refactoring
and future rework hard as the interface for the module becomes to
chaotic. This small series aims to create two helpers to hide the
private data.

This is done as a small preparation before a third, new, users of the
Gen4 PTP will be added in a follow up series.
====================

Link: https://patch.msgid.link/20260201183745.1075399-1-niklas.soderlund+renesas@ragnatech.se
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:35:40 -08:00
Niklas Söderlund
9c2f568eb2 net: ethernet: renesas: rcar_gen4_ptp: Hide private data from users
The Gen4 PTP helper module is already used by RTSN and RSWITCH to
support PTP clocks and will be used by RAVB too. Hide the Gen4 PTP
private data structure to make sure none of the users poke at it.

This will be more important for RAVB use-cases as more then one RAVB
device will need to cooperate using one PTP clock source.

Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Link: https://patch.msgid.link/20260201183745.1075399-5-niklas.soderlund+renesas@ragnatech.se
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:35:38 -08:00
Niklas Söderlund
5640afa058 net: ethernet: renesas: rcar_gen4_ptp: Add helper to read time
Instead of accessing the Gen4 PTP specific structure directly in drivers
add a helper to read the time. This is done in preparation to
completely hide the Gen4 PTP specific structure from users.

Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Link: https://patch.msgid.link/20260201183745.1075399-4-niklas.soderlund+renesas@ragnatech.se
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:35:38 -08:00
Niklas Söderlund
9afe65e7e7 net: ethernet: renesas: rcar_gen4_ptp: Add helper to get clock index
Instead of accessing the Gen4 PTP specific structure directly in drivers
add a helper to read the clock index. This is done in preparation to
completely hide the Gen4 PTP specific structure from users.

Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Link: https://patch.msgid.link/20260201183745.1075399-3-niklas.soderlund+renesas@ragnatech.se
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:35:38 -08:00
Niklas Söderlund
642377346a net: ethernet: renesas: rcar_gen4_ptp: Move address assignment
Instead of accessing the Gen4 PTP specific structure directly in drivers
move the device address assignment into the preparation call. This is
done in preparation to completely hide the Gen4 PTP specific structure
from users.

Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Link: https://patch.msgid.link/20260201183745.1075399-2-niklas.soderlund+renesas@ragnatech.se
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:35:37 -08:00
Colin Ian King
1982257570 scsi: csiostor: Fix dereference of null pointer rn
The error exit path when rn is NULL ends up deferencing the null pointer rn
via the use of the macro CSIO_INC_STATS. Fix this by adding a new error
return path label after the use of the macro to avoid the deference.

Fixes: a3667aaed5 ("[SCSI] csiostor: Chelsio FCoE offload driver")
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Link: https://patch.msgid.link/20260129155332.196338-1-colin.i.king@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-02-03 22:33:32 -05:00
Arnd Bergmann
e17f0d4cc0 scsi: buslogic: Reduce stack usage
Some randconfig builds run into excessive stack usage with gcc-14 or
higher, which use __attribute__((cold)) where earlier versions did not do
that:

drivers/scsi/BusLogic.c: In function 'blogic_init':
drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]

The problem is that a lot of code gets inlined into blogic_init() here. Two
functions stick out, but they are a bit different:

 - blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel
   stack, which is a problem in combination with other functions that also
   do. Marking this one as noinline means that the stack slots get get
   reused between function calls

 - blogic_reportconfig() has a few large variables, but whenever it is not
   inlined into its caller, the compiler is actually smart enough to reuse
   stack slots for these automatically, so marking it as noinline saves
   most of the stack space by itself.

The combination of both of these should avoid the problem entirely.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-02-03 22:31:13 -05:00
Eric Biggers
ffd42b6d04 lib/crypto: mldsa: Clarify the documentation for mldsa_verify() slightly
mldsa_verify() implements ML-DSA.Verify with ctx='', so document this
more explicitly.  Remove the one-liner comment above mldsa_verify()
which was somewhat misleading.

Reviewed-by: David Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/r/20260202221552.174341-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-02-03 19:28:51 -08:00
Arnd Bergmann
bbb8d98fb4 scsi: ufs: host: mediatek: Require CONFIG_PM
The added print statement from a recent fix causes the driver to fail
building when CONFIG_PM is disabled:

drivers/ufs/host/ufs-mediatek.c: In function 'ufs_mtk_resume':
drivers/ufs/host/ufs-mediatek.c:1890:40: error: 'struct dev_pm_info' has no member named 'request'
 1890 |                         hba->dev->power.request,

It seems unlikely that the driver can work at all without CONFIG_PM, so
just add a dependency and remove the existing ifdef checks, rather than
adding another ifdef.

Fixes: 15ef3f5aa8 ("scsi: ufs: host: mediatek: Enhance recovery on resume failure")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://patch.msgid.link/20260202095052.1232703-1-arnd@kernel.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-02-03 22:28:44 -05:00
Jakub Kicinski
279fe484dd Merge branch 'gve-stats-reporting-fixes'
Max Yuan says:

====================
gve: Stats reporting fixes

This series addresses two issues related to statistics in the gve driver.

The first patch fixes a memory corruption issue that occurs when resizing
the stats region during queue count changes. By allocating the maximum
possible size upfront and aligning offset calculations with the NIC,
we ensure stability and accuracy across reconfigurations.

The second patch fixes the 'rx_dropped' counter by removing allocation
failures and incorporating XDP transmit and redirect errors to provide
a more accurate representation of dropped packets.
====================

Link: https://patch.msgid.link/20260202193925.3106272-1-hramamurthy@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:28:08 -08:00
Max Yuan
c7db85d579 gve: Correct ethtool rx_dropped calculation
The gve driver's "rx_dropped" statistic, exposed via `ethtool -S`,
incorrectly includes `rx_buf_alloc_fail` counts. These failures
represent an inability to allocate receive buffers, not true packet
drops where a received packet is discarded. This misrepresentation can
lead to inaccurate diagnostics.

This patch rectifies the ethtool "rx_dropped" calculation. It removes
`rx_buf_alloc_fail` from the total and adds `xdp_tx_errors` and
`xdp_redirect_errors`, which represent legitimate packet drops within
the XDP path.

Cc: stable@vger.kernel.org
Fixes: 433e274b8f ("gve: Add stats for gve.")
Signed-off-by: Max Yuan <maxyuan@google.com>
Reviewed-by: Jordan Rhee <jordanrhee@google.com>
Reviewed-by: Joshua Washington <joshwash@google.com>
Reviewed-by: Matt Olson <maolson@google.com>
Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20260202193925.3106272-3-hramamurthy@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:28:05 -08:00
Debarghya Kundu
7b9ebcce02 gve: Fix stats report corruption on queue count change
The driver and the NIC share a region in memory for stats reporting.
The NIC calculates its offset into this region based on the total size
of the stats region and the size of the NIC's stats.

When the number of queues is changed, the driver's stats region is
resized. If the queue count is increased, the NIC can write past
the end of the allocated stats region, causing memory corruption.
If the queue count is decreased, there is a gap between the driver
and NIC stats, leading to incorrect stats reporting.

This change fixes the issue by allocating stats region with maximum
size, and the offset calculation for NIC stats is changed to match
with the calculation of the NIC.

Cc: stable@vger.kernel.org
Fixes: 24aeb56f2d ("gve: Add Gvnic stats AQ command and ethtool show/set-priv-flags.")
Signed-off-by: Debarghya Kundu <debarghyak@google.com>
Reviewed-by: Joshua Washington <joshwash@google.com>
Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20260202193925.3106272-2-hramamurthy@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:28:05 -08:00
Keita Morisaki
9672ed3de7 scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event
The ufs_mtk_clk_scale() trace event currently stores the address of the
name string directly via __field(const char *, name). This pointer may
become invalid after the module is unloaded, causing page faults when the
trace buffer is subsequently accessed.

This can occur because the MediaTek UFS driver can be configured as a
loadable module (tristate in Kconfig), meaning the name string passed to
the trace event may reside in module memory that becomes invalid after
module unload.

Fix this by using __string() and __assign_str() to copy the string contents
into the ring buffer instead of storing the pointer. This ensures the trace
data remains valid regardless of module state.

This change increases the memory usage for each ftrace entry by a few bytes
(clock names are typically 7-15 characters like "ufs_sel" or
"ufs_sel_max_src") compared to storing an 8-byte pointer.

Note that this change does not affect anything unless all of the following
conditions are met:

 - CONFIG_SCSI_UFS_MEDIATEK is enabled

 - ftrace tracing is enabled

 - The ufs_mtk_clk_scale event is enabled in ftrace

Signed-off-by: Keita Morisaki <keita.morisaki@tier4.jp>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Link: https://patch.msgid.link/20260202024526.122515-1-keita.morisaki@tier4.jp
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-02-03 22:25:49 -05:00
Jakub Kicinski
6788d44b93 Merge branch 'net-gro-fix-outer-network-offset'
Paolo Abeni says:

====================
net: gro: fix outer network offset

The GRO stage has still problems in some edge scenarios when dealing
with encapsulated traffic: the first patch address an issue there
leading to bad checksums.

The second patch introduces a test case covering the relevant scenario:
S/W segmentation after GRO for encapsulated traffic.
====================

Link: https://patch.msgid.link/cover.1770032084.git.pabeni@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:23:47 -08:00
Paolo Abeni
bee60ce21b selftest: net: add a test-case for encap segmentation after GRO
We had a few patches in this area and no explicit coverage so far.
The test case covers the scenario addressed by the previous fix;
reusing the existing udpgro_fwd.sh script to leverage part of the
of the virtual network setup, even if such script is possibly not
a perfect fit.

Note that the mentioned script already contains several shellcheck
violation; this patch does not fix the existing code, just avoids
adding more issues in the new one.

Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Link: https://patch.msgid.link/768ca132af81e83856e34d3105b86c37e566a7ad.1770032084.git.pabeni@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:23:41 -08:00
Paolo Abeni
5c2c3c38be net: gro: fix outer network offset
The udp GRO complete stage assumes that all the packets inserted the RX
have the `encapsulation` flag zeroed. Such assumption is not true, as a
few H/W NICs can set such flag when H/W offloading the checksum for
an UDP encapsulated traffic, the tun driver can inject GSO packets with
UDP encapsulation and the problematic layout can also be created via
a veth based setup.

Due to the above, in the problematic scenarios, udp4_gro_complete() uses
the wrong network offset (inner instead of outer) to compute the outer
UDP header pseudo checksum, leading to csum validation errors later on
in packet processing.

Address the issue always clearing the encapsulation flag at GRO completion
time. Such flag will be set again as needed for encapsulated packets by
udp_gro_complete().

Fixes: 5ef31ea5d0 ("net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb")
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/562638dbebb3b15424220e26a180274b387e2a88.1770032084.git.pabeni@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:23:41 -08:00
Zilin Guan
41b37312bd scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
pqi_report_phys_luns() fails to release the rpl_list buffer when
encountering an unsupported data format or when the allocation for
rpl_16byte_wwid_list fails. These early returns bypass the cleanup logic,
leading to memory leaks.

Consolidate the error handling by adding an out_free_rpl_list label and use
goto statements to ensure rpl_list is consistently freed on failure.

Compile tested only. Issue found using a prototype static analysis tool and
code review.

Fixes: 28ca6d876c ("scsi: smartpqi: Add extended report physical LUNs")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Tested-by: Don Brace <don.brace@microchip.com>
Acked-by: Don Brace <don.brace@microchip.com>
Link: https://patch.msgid.link/20260131093641.1008117-1-zilin@seu.edu.cn
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-02-03 22:23:32 -05:00
Eric Dumazet
f613e8b4af net: add proper RCU protection to /proc/net/ptype
Yin Fengwei reported an RCU stall in ptype_seq_show() and provided
a patch.

Real issue is that ptype_seq_next() and ptype_seq_show() violate
RCU rules.

ptype_seq_show() runs under rcu_read_lock(), and reads pt->dev
to get device name without any barrier.

At the same time, concurrent writers can remove a packet_type structure
(which is correctly freed after an RCU grace period) and clear pt->dev
without an RCU grace period.

Define ptype_iter_state to carry a dev pointer along seq_net_private:

struct ptype_iter_state {
	struct seq_net_private	p;
	struct net_device	*dev; // added in this patch
};

We need to record the device pointer in ptype_get_idx() and
ptype_seq_next() so that ptype_seq_show() is safe against
concurrent pt->dev changes.

We also need to add full RCU protection in ptype_seq_next().
(Missing READ_ONCE() when reading list.next values)

Many thanks to Dong Chenchen for providing a repro.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Fixes: 1d10f8a1f4 ("net-procfs: show net devices bound packet types")
Fixes: c353e8983e ("net: introduce per netns packet chains")
Reported-by: Yin Fengwei <fengwei_yin@linux.alibaba.com>
Reported-by: Dong Chenchen <dongchenchen2@huawei.com>
Closes: https://lore.kernel.org/netdev/CANn89iKRRKPnWjJmb-_3a=sq+9h6DvTQM4DBZHT5ZRGPMzQaiA@mail.gmail.com/T/#m7b80b9fc9b9267f90e0b7aad557595f686f9c50d

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Tested-by: Yin Fengwei <fengwei_yin@linux.alibaba.com>
Link: https://patch.msgid.link/20260202205217.2881198-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:20:30 -08:00
Guixin Liu
21a16f0f02 scsi: mpi3mr: Make driver probing asynchronous
Speed up the boot process by using the asynchronous probing feature
supported by the kernel.

Set the PROBE_PREFER_ASYNCHRONOUS flag in the device_driver structure so
that the driver core probes in parallel.

Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://patch.msgid.link/20260130080207.90053-1-kanie@linux.alibaba.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-02-03 22:19:56 -05:00
David Corvaglia
6dfa3df797 net: bridge: use sysfs_emit instead of sprintf
Replace sprintf with sysfs_emit in sysfs show() methods as outlined in
Documentation/filesystems/sysfs.rst.

sysfs_emit is preferred to sprintf in sysfs show() methods as it is safer
with buffer handling.

Signed-off-by: David Corvaglia <david@corvaglia.dev>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/0100019c1fc2bcc3-bc9ca2f1-22d7-4250-8441-91e4af57117b-000000@email.amazonses.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:19:42 -08:00
Thomas Yen
f8ef441811 scsi: ufs: core: Flush exception handling work when RPM level is zero
Ensure that the exception event handling work is explicitly flushed during
suspend when the runtime power management level is set to UFS_PM_LVL_0.

When the RPM level is zero, the device power mode and link state both
remain active. Previously, the UFS core driver bypassed flushing exception
event handling jobs in this configuration. This created a race condition
where the driver could attempt to access the host controller to handle an
exception after the system had already entered a deep power-down state,
resulting in a system crash.

Explicitly flush this work and disable auto BKOPs before the suspend
callback proceeds. This guarantees that pending exception tasks complete
and prevents illegal hardware access during the power-down sequence.

Fixes: 57d104c153 ("ufs: add UFS power management support")
Signed-off-by: Thomas Yen <thomasyen@google.com>
Cc: Stable Tree <stable@vger.kernel.org>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260129165156.956601-1-thomasyen@google.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-02-03 22:17:43 -05:00
Chen Ni
78211543d2 net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi()
The devm_gpiod_get_optional() function may return an ERR_PTR in case of
genuine GPIO acquisition errors, not just NULL which indicates the
legitimate absence of an optional GPIO.

Add an IS_ERR() check after the call in adin1110_check_spi(). On error,
return the error code to ensure proper failure handling rather than
proceeding with invalid pointers.

Fixes: 36934cac7a ("net: ethernet: adi: adin1110: add reset GPIO")
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Link: https://patch.msgid.link/20260202040228.4129097-1-nichen@iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:11:58 -08:00
Alok Tiwari
1384a81e54 bng_en: fix misleading error message for generic firmware version
The devlink info_get handler incorrectly reports "roce firmware" when
populating the generic firmware version field.

Update the error message to correctly describe the failing operation.

Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com>
Link: https://patch.msgid.link/20260202033848.22993-1-alok.a.tiwari@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-03 19:11:29 -08:00
Corey Minyard
6b157b408d ipmi:ls2k: Make ipmi_ls2k_platform_driver static
No need for it to be global.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202601170753.3zDBerGP-lkp@intel.com/
Signed-off-by: Corey Minyard <corey@minyard.net>
2026-02-03 21:06:19 -06:00
Matt Johnston
9f235ccecd ipmi: ipmb: initialise event handler read bytes
IPMB doesn't use i2c reads, but the handler needs to set a value.
Otherwise an i2c read will return an uninitialised value from the bus
driver.

Fixes: 63c4eb3471 ("ipmi:ipmb: Add initial support for IPMI over IPMB")
Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
Message-ID: <20260113-ipmb-read-init-v1-1-a9cbce7b94e3@codeconstruct.com.au>
Signed-off-by: Corey Minyard <corey@minyard.net>
2026-02-03 21:06:18 -06:00
Corey Minyard
1d90e6c1a5 ipmi: Consolidate the run to completion checking for xmit msgs lock
It made things hard to read, move the check to a function.

Signed-off-by: Corey Minyard <corey@minyard.net>
Reviewed-by: Breno Leitao <leitao@debian.org>
2026-02-03 21:06:18 -06:00
Corey Minyard
594c11d0e1 ipmi: Fix use-after-free and list corruption on sender error
The analysis from Breno:

When the SMI sender returns an error, smi_work() delivers an error
response but then jumps back to restart without cleaning up properly:

1. intf->curr_msg is not cleared, so no new message is pulled
2. newmsg still points to the message, causing sender() to be called
   again with the same message
3. If sender() fails again, deliver_err_response() is called with
   the same recv_msg that was already queued for delivery

This causes list_add corruption ("list_add double add") because the
recv_msg is added to the user_msgs list twice. Subsequently, the
corrupted list leads to use-after-free when the memory is freed and
reused, and eventually a NULL pointer dereference when accessing
recv_msg->done.

The buggy sequence:

  sender() fails
    -> deliver_err_response(recv_msg)  // recv_msg queued for delivery
    -> goto restart                    // curr_msg not cleared!
  sender() fails again (same message!)
    -> deliver_err_response(recv_msg)  // tries to queue same recv_msg
    -> LIST CORRUPTION

Fix this by freeing the message and setting it to NULL on a send error.
Also, always free the newmsg on a send error, otherwise it will leak.

Reported-by: Breno Leitao <leitao@debian.org>
Closes: https://lore.kernel.org/lkml/20260127-ipmi-v1-0-ba5cc90f516f@debian.org/
Fixes: 9cf93a8fa9 ("ipmi: Allow an SMI sender to return an error")
Cc: stable@vger.kernel.org # 4.18
Reviewed-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Corey Minyard <corey@minyard.net>
2026-02-03 21:02:54 -06:00
Sebastian Andrzej Siewior
1508301d4a scsi: efct: Use IRQF_ONESHOT and default primary handler
There is no added value in efct_intr_msix() compared to
irq_default_primary_handler().

Using a threaded interrupt without a dedicated primary handler mandates the
IRQF_ONESHOT flag to mask the interrupt source while the threaded handler
is active. Otherwise the interrupt can fire again before the threaded
handler had a chance to run.

Use the default primary interrupt handler by specifying NULL and set
IRQF_ONESHOT so the interrupt source is masked until the secondary handler
is done.

Cc: Ram Vegesna <ram.vegesna@broadcom.com>
Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org
Cc: target-devel@vger.kernel.org
Fixes: 4df84e8466 ("scsi: elx: efct: Driver initialization routines")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/20260123113708.416727-8-bigeasy@linutronix.de
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-02-03 22:02:08 -05:00
Peng Fan
39451ebcf7 dt-bindings: firmware: fsl,scu: Mark multi-channel MU layouts as deprecated
The SCU MU driver has already supported the simple and efficient single-TX
and single-RX channel layout since 2021. The older multi-channel MU
configurations (tx0..tx3 and rx0..rx3) are less efficient in practice and
not needed.

Mark these legacy mbox-names and mboxes tuple layouts as deprecated in the
binding schema. The driver continues to support them for backward
compatibility in case firmware publishes the legacy properties.

The example section is updated accordingly to demonstrate the recommended
layout.

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260127-scu-v2-1-03f3aaa56e1b@nxp.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-02-03 20:58:13 -06:00