summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-01-31hwmon: (fam15h_power) Use generic power managementVaibhav Gupta
Switch to the generic PCI power management framework and remove legacy .resume() callback. With the generic framework, the standard PCI related work like: - pci_save/restore_state() - pci_enable/disable_device() - pci_set_power_state() is handled by the PCI core and this driver should implement only device specific operations in its respective callback function. Signed-off-by: Vaibhav Gupta <vaibhavgupta40@gmail.com> Link: https://lore.kernel.org/r/20251216181401.598273-1-vaibhavgupta40@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-01-31hwmon: (sht3x) add support for SHT85Antoni Pokusinski
SHT85 is a temperature and humidity sensor with the same interface as SHT3x. Signed-off-by: Antoni Pokusinski <apokusinski01@gmail.com> Link: https://lore.kernel.org/r/20251211185842.66084-1-apokusinski01@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-01-31hwmon: (asus-ec-sensors) add Pro WS TRX50-SAGE WIFI ARobert McIntyre
Adding support for Pro WS TRX50-SAGE WIFI A, which is identical sensors-wise to Pro WS TRX50-SAGE WIFI Signed-off-by: Robert McIntyre <rjmcinty@hotmail.com> Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com> Link: https://lore.kernel.org/r/20251213200531.259435-4-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-01-31hwmon: (asus-ec-sensors) add ROG MAXIMUS X HEROReis Holmes
Add support for ROG MAXIMUS X HERO. The support is incomplete because the second EC, which provides part of the data, is inaccessible via the kernel ec module. Signed-off-by: Reis Holmes <reisholmes@pm.me> Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com> Link: https://lore.kernel.org/r/20251213200531.259435-3-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-01-31hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()Rafael J. Wysocki
The acpi_power_meter driver's .notify() callback function, acpi_power_meter_notify(), calls hwmon_device_unregister() under a lock that is also acquired by callbacks in sysfs attributes of the device being unregistered which is prone to deadlocks between sysfs access and device removal. Address this by moving the hwmon device removal in acpi_power_meter_notify() outside the lock in question, but notice that doing it alone is not sufficient because two concurrent METER_NOTIFY_CONFIG notifications may be attempting to remove the same device at the same time. To prevent that from happening, add a new lock serializing the execution of the switch () statement in acpi_power_meter_notify(). For simplicity, it is a static mutex which should not be a problem from the performance perspective. The new lock also allows the hwmon_device_register_with_info() in acpi_power_meter_notify() to be called outside the inner lock because it prevents the other notifications handled by that function from manipulating the "resource" object while the hwmon device based on it is being registered. The sending of ACPI netlink messages from acpi_power_meter_notify() is serialized by the new lock too which generally helps to ensure that the order of handling firmware notifications is the same as the order of sending netlink messages related to them. In addition, notice that hwmon_device_register_with_info() may fail in which case resource->hwmon_dev will become an error pointer, so add checks to avoid attempting to unregister the hwmon device pointer to by it in that case to acpi_power_meter_notify() and acpi_power_meter_remove(). Fixes: 16746ce8adfe ("hwmon: (acpi_power_meter) Replace the deprecated hwmon_device_register") Closes: https://lore.kernel.org/linux-hwmon/CAK8fFZ58fidGUCHi5WFX0uoTPzveUUDzT=k=AAm4yWo3bAuCFg@mail.gmail.com/ Reported-by: Jaroslav Pulchart <jaroslav.pulchart@gooddata.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-01-31ublk: remove "can't touch 'ublk_io' any more" commentsCaleb Sander Mateos
The struct ublk_io is in fact accessed in __ublk_complete_rq() after the comment. But it's not racy to access the ublk_io between clearing its UBLK_IO_FLAG_OWNED_BY_SRV flag and completing the request, as no other thread can use the ublk_io in the meantime. Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Reviewed-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-31ublk: add UBLK_F_NO_AUTO_PART_SCAN feature flagMing Lei
Add a new feature flag UBLK_F_NO_AUTO_PART_SCAN to allow users to suppress automatic partition scanning when starting a ublk device. This is useful for some cases in which user don't want to scan partitions. Users still can manually trigger partition scanning later when appropriate using standard tools (e.g., partprobe, blockdev --rereadpt). Reported-by: Yoav Cohen <yoav@nvidia.com> Link: https://lore.kernel.org/linux-block/DM4PR12MB63280C5637917C071C2F0D65A9A8A@DM4PR12MB6328.namprd12.prod.outlook.com/ Signed-off-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-31ublk: check list membership before cancelling batch fetch commandMing Lei
Add !list_empty(&fcmd->node) check in ublk_batch_cancel_cmd() to ensure the fcmd hasn't already been removed from the list. Once an fcmd is removed from the list, it's considered claimed by whoever removed it and will be freed by that path. Meantime switch to list_del_init() for deleting it from list. Signed-off-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-31ublk: drop ublk_ctrl_start_recovery() header argumentCaleb Sander Mateos
ublk_ctrl_start_recovery() only uses its const struct ublksrv_ctrl_cmd * header argument to log the dev_id. But this value is already available in struct ublk_device's ub_number field. So log ub_number instead and drop the unused header argument. Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Reviewed-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-31ublk: use READ_ONCE() to read struct ublksrv_ctrl_cmdCaleb Sander Mateos
struct ublksrv_ctrl_cmd is part of the io_uring_sqe, which may lie in userspace-mapped memory. It's racy to access its fields with normal loads, as userspace may write to them concurrently. Use READ_ONCE() to copy the ublksrv_ctrl_cmd from the io_uring_sqe to the stack. Use the local copy in place of the one in the io_uring_sqe. Fixes: 87213b0d847c ("ublk: allow non-blocking ctrl cmds in IO_URING_F_NONBLOCK issue") Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Reviewed-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-31ublk: Validate SQE128 flag before accessing the cmdGovindarajulu Varadarajan
ublk_ctrl_cmd_dump() accesses (header *)sqe->cmd before IO_URING_F_SQE128 flag check. This could cause out of boundary memory access. Move the SQE128 flag check earlier in ublk_ctrl_uring_cmd() to return -EINVAL immediately if the flag is not set. Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Signed-off-by: Govindarajulu Varadarajan <govind.varadar@gmail.com> Reviewed-by: Caleb Sander Mateos <csander@purestorage.com> Reviewed-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-31iommu/tegra241-cmdqv: Reset VCMDQ in tegra241_vcmdq_hw_init_user()Nicolin Chen
The Enable bits in CMDQV/VINTF/VCMDQ_CONFIG registers do not actually reset the HW registers. So, the driver explicitly clears all the registers when a VINTF or VCMDQ is being initialized calling its hw_deinit() function. However, a userspace VCMDQ is not properly reset, unlike an in-kernel VCMDQ getting reset in tegra241_vcmdq_hw_init(). Meanwhile, tegra241_vintf_hw_init() calling tegra241_vintf_hw_deinit() will not deinit any VCMDQ, since there is no userspace VCMDQ mapped to the VINTF at that stage. Then, this may result in dirty VCMDQ registers, which can fail the VM. Like tegra241_vcmdq_hw_init(), reset a VCMDQ in tegra241_vcmdq_hw_init() to fix this bug. This is required by a host kernel. Fixes: 6717f26ab1e7 ("iommu/tegra241-cmdqv: Add user-space use support") Cc: stable@vger.kernel.org Reported-by: Bao Nguyen <ncqb@google.com> Signed-off-by: Nicolin Chen <nicolinc@nvidia.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-01-31crypto: caam - fix netdev memory leak in dpaa2_caam_probeJianpeng Chang
When commit 0e1a4d427f58 ("crypto: caam: Unembed net_dev structure in dpaa2") converted embedded net_device to dynamically allocated pointers, it added cleanup in dpaa2_dpseci_disable() but missed adding cleanup in dpaa2_dpseci_free() for error paths. This causes memory leaks when dpaa2_dpseci_dpio_setup() fails during probe due to DPIO devices not being ready yet. The kernel's deferred probe mechanism handles the retry successfully, but the netdevs allocated during the failed probe attempt are never freed, resulting in kmemleak reports showing multiple leaked netdev-related allocations all traced back to dpaa2_caam_probe(). Fix this by preserving the CPU mask of allocated netdevs during setup and using it for cleanup in dpaa2_dpseci_free(). This approach ensures that only the CPUs that actually had netdevs allocated will be cleaned up, avoiding potential issues with CPU hotplug scenarios. Fixes: 0e1a4d427f58 ("crypto: caam: Unembed net_dev structure in dpaa2") Signed-off-by: Jianpeng Chang <jianpeng.chang.cn@windriver.com> Reviewed-by: Breno Leitao <leitao@debian.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-01-31crypto: hisilicon/qm - increase wait time for mailboxWeili Qian
The device requires more time to process queue stop and function stop mailbox commands compared to other mailbox commands . In the current driver, the mailbox processing wait time for queue stop and function stop is less than the device timeout, which may cause the driver to incorrectly assume that the mailbox processing has failed. Therefore, the driver wait time for queue stop and function stop should be set to be greater than the device timeout. And PF and VF communication relies on mailbox, the communication wait time should also be modified. Signed-off-by: Weili Qian <qianweili@huawei.com> Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-01-31crypto: hisilicon/qm - obtain the mailbox configuration at one timeWeili Qian
The malibox needs to be triggered by a 128bit atomic operation. The reason is that the PF and VFs of the device share the mmio memory of the mailbox, and the mutex cannot lock mailbox operations in different functions, especially when passing through VFs to virtual machines. Currently, the write operation to the mailbox is already a 128-bit atomic write. The read operation also needs to be modified to a 128-bit atomic read. Since there is no general 128-bit IO memory access API in the current ARM64 architecture, and the stp and ldp instructions do not guarantee atomic access to device memory, they cannot be extracted as a general API. Therefore, the 128-bit atomic read and write operations need to be implemented in the driver. Signed-off-by: Weili Qian <qianweili@huawei.com> Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-01-31crypto: hisilicon/qm - remove unnecessary code in qm_mb_write()Weili Qian
Since the HiSilicon accelerator is used only on the ARM64 architectures, the implementations for other architectures are not needed, so remove the unnecessary code. Signed-off-by: Weili Qian <qianweili@huawei.com> Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-01-31crypto: hisilicon/qm - move the barrier before writing to the mailbox registerChenghai Huang
Before sending the data via the mailbox to the hardware, to ensure that the data accessed by the hardware is the most up-to-date, a write barrier should be added before writing to the mailbox register. The current memory barrier is placed after writing to the register, the barrier order should be modified to be before writing to the register. Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-01-31crypto: hisilicon/trng - support tfms sharing the deviceWeili Qian
Since the number of devices is limited, and the number of tfms may exceed the number of devices, to ensure that tfms can be successfully allocated, support tfms sharing the same device. Fixes: e4d9d10ef4be ("crypto: hisilicon/trng - add support for PRNG") Signed-off-by: Weili Qian <qianweili@huawei.com> Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-01-31crypto: hisilicon/zip - add lz4 algorithm for hisi_zipChenghai Huang
Add the "hisi-lz4-acomp" algorithm by the crypto acomp. When the 8th bit of the capability register is 1, the lz4 algorithm will register to crypto acomp, and the window length is configured to 16K by default. Since the "hisi-lz4-acomp" currently only support compression direction, decompression is completed by the soft lz4 algorithm. Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-01-31s390/pkey: Support new xflag PKEY_XFLAG_NOCLEARKEYHarald Freudenberger
Introduce a new xflag PKEY_XFLAG_NOCLEARKEY which when given refuses the conversion of "clear key tokens" to protected key material. Some algorithms (PAES, PHMAC) have the need to construct "clear key tokens" to be used during selftest. But in general these algorithms should only support clear key material for testing purpose. So now the algorithm implementation can signal via xflag PKEY_XFLAG_NOCLEARKEY that a conversion of clear key material to protected key is not acceptable and thus the pkey layer (usually one of the handler modules) refuses clear key material with -EINVAL. Signed-off-by: Harald Freudenberger <freude@linux.ibm.com> Reviewed-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-01-31crypto: stm32 - Replace min_t(size_t) with just min()Thorsten Blum
In most cases, min_t(size_t) and explicit casting are unnecessary because the values ->hw_blocksize, ->payload_{in,out}, and ->header_in are already of type 'size_t'. Use the simpler min() macro instead. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-01-31crypto: virtio - Replace package id with numa node idBibo Mao
With multiple virtio crypto devices supported with different NUMA nodes, when crypto session is created, it will search virtio crypto device with the same numa node of current CPU. Here API topology_physical_package_id() is replaced with cpu_to_node() since package id is physical concept, and one package id have multiple memory numa id. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-01-31crypto: virtio - Remove duplicated virtqueue_kick in ↵Bibo Mao
virtio_crypto_skcipher_crypt_req With function virtio_crypto_skcipher_crypt_req(), there is already virtqueue_kick() call with spinlock held in function __virtio_crypto_skcipher_do_req(). Remove duplicated virtqueue_kick() function call here. Fixes: d79b5d0bbf2e ("crypto: virtio - support crypto engine framework") Cc: stable@vger.kernel.org Signed-off-by: Bibo Mao <maobibo@loongson.cn> Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-01-31crypto: virtio - Add spinlock protection with virtqueue notificationBibo Mao
When VM boots with one virtio-crypto PCI device and builtin backend, run openssl benchmark command with multiple processes, such as openssl speed -evp aes-128-cbc -engine afalg -seconds 10 -multi 32 openssl processes will hangup and there is error reported like this: virtio_crypto virtio0: dataq.0:id 3 is not a head! It seems that the data virtqueue need protection when it is handled for virtio done notification. If the spinlock protection is added in virtcrypto_done_task(), openssl benchmark with multiple processes works well. Fixes: fed93fb62e05 ("crypto: virtio - Handle dataq logic with tasklet") Cc: stable@vger.kernel.org Signed-off-by: Bibo Mao <maobibo@loongson.cn> Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-01-30net: usb: r8152: fix resume reset deadlockSergey Senozhatsky
rtl8152 can trigger device reset during reset which potentially can result in a deadlock: **** DPM device timeout after 10 seconds; 15 seconds until panic **** Call Trace: <TASK> schedule+0x483/0x1370 schedule_preempt_disabled+0x15/0x30 __mutex_lock_common+0x1fd/0x470 __rtl8152_set_mac_address+0x80/0x1f0 dev_set_mac_address+0x7f/0x150 rtl8152_post_reset+0x72/0x150 usb_reset_device+0x1d0/0x220 rtl8152_resume+0x99/0xc0 usb_resume_interface+0x3e/0xc0 usb_resume_both+0x104/0x150 usb_resume+0x22/0x110 The problem is that rtl8152 resume calls reset under tp->control mutex while reset basically re-enters rtl8152 and attempts to acquire the same tp->control lock once again. Reset INACCESSIBLE device outside of tp->control mutex scope to avoid recursive mutex_lock() deadlock. Fixes: 4933b066fefb ("r8152: If inaccessible at resume time, issue a reset") Reviewed-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org> Link: https://patch.msgid.link/20260129031106.3805887-1-senozhatsky@chromium.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30net: wwan: mhi_wwan_ctrl: Add NMEA channel supportSlark Xiao
For MHI WWAN device, we need a match between NMEA channel and WWAN_PORT_NMEA type. Then the GNSS subsystem could create the gnss device succssfully. Signed-off-by: Slark Xiao <slark_xiao@163.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20260126062158.308598-9-slark_xiao@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30net: wwan: hwsim: support NMEA port emulationSergey Ryazanov
Support NMEA port emulation for the WWAN core GNSS port testing purpose. Emulator produces pair of GGA + RMC sentences every second what should be enough to fool gpsd into believing it is working with a NMEA GNSS receiver. If the GNSS system is enabled then one NMEA port will be created automatically for the simulated WWAN device. Manual NMEA port creation is not supported at the moment. Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20260126062158.308598-8-slark_xiao@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30net: wwan: hwsim: refactor to support more port typesSergey Ryazanov
Just introduced WWAN NMEA port type needs a testing option. The WWAN HW simulator was developed with the AT port type in mind and cannot be easily extended. Refactor it now to make it capable to support more port types. No big functional changes, mostly renaming with a little code rearrangement. Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20260126062158.308598-7-slark_xiao@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30net: wwan: add NMEA port supportSergey Ryazanov
Many WWAN modems come with embedded GNSS receiver inside and have a dedicated port to output geopositioning data. On the one hand, the GNSS receiver has little in common with WWAN modem and just shares a host interface and should be exported using the GNSS subsystem. On the other hand, GNSS receiver is not automatically activated and needs a generic WWAN control port (AT, MBIM, etc.) to be turned on. And a user space software needs extra information to find the control port. Introduce the new type of WWAN port - NMEA. When driver asks to register a NMEA port, the core allocates common parent WWAN device as usual, but exports the NMEA port via the GNSS subsystem and acts as a proxy between the device driver and the GNSS subsystem. From the WWAN device driver perspective, a NMEA port is registered as a regular WWAN port without any difference. And the driver interacts only with the WWAN core. From the user space perspective, the NMEA port is a GNSS device which parent can be used to enumerate and select the proper control port for the GNSS receiver management. CC: Slark Xiao <slark_xiao@163.com> CC: Muhammad Nuzaihan <zaihan@unrealasia.net> CC: Qiang Yu <quic_qianyu@quicinc.com> CC: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> CC: Johan Hovold <johan@kernel.org> Suggested-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20260126062158.308598-6-slark_xiao@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30net: wwan: core: split port unregister and stopSergey Ryazanov
Upcoming GNSS (NMEA) port type support requires exporting it via the GNSS subsystem. On another hand, we still need to do basic WWAN core work: call the port stop operation, purge queues, release the parent WWAN device, etc. To reuse as much code as possible, split the port unregistering function into the deregistration of a regular WWAN port device, and the common port tearing down code. In order to keep more code generic, break the device_unregister() call into device_del() and put_device(), which release the port memory uniformly. Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20260126062158.308598-5-slark_xiao@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30net: wwan: core: split port creation and registrationSergey Ryazanov
Upcoming GNSS (NMEA) port type support requires exporting it via the GNSS subsystem. On another hand, we still need to do basic WWAN core work: find or allocate the WWAN device, make it the port parent, etc. To reuse as much code as possible, split the port creation function into the registration of a regular WWAN port device, and basic port struct initialization. To be able to use put_device() uniformly, break the device_register() call into device_initialize() and device_add() and call device initialization earlier. While at it, fix a minor number leak upon WWAN port registration failure. Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com> Link: https://patch.msgid.link/20260126062158.308598-4-slark_xiao@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30net: wwan: core: explicit WWAN device reference countingSergey Ryazanov
We need information about existing WWAN device children since we remove the device after removing the last child. Previously, we tracked users implicitly by checking whether ops was registered and existence of a child device of the wwan_class class. Upcoming GNSS (NMEA) port type support breaks this approach by introducing a child device of the gnss_class class. And a modem driver can easily trigger a kernel Oops by removing regular (e.g., MBIM, AT) ports first and then removing a GNSS port. The WWAN device will be unregistered on removal of a last regular WWAN port. And subsequent GNSS port removal will cause NULL pointer dereference in simple_recursive_removal(). In order to support ports of classes other than wwan_class, switch to explicit references counting. Introduce a dedicated counter to the WWAN device struct, increment it on every wwan_create_dev() call, decrement on wwan_remove_dev(), and actually unregister the WWAN device when there are no more references. Run tested with wwan_hwsim with NMEA support patches applied and different port removing sequences. Reported-by: Daniele Palmas <dnlplm@gmail.com> Closes: https://lore.kernel.org/netdev/CAGRyCJE28yf-rrfkFbzu44ygLEvoUM7fecK1vnrghjG_e9UaRA@mail.gmail.com/ Suggested-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com> Link: https://patch.msgid.link/20260126062158.308598-3-slark_xiao@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30net: wwan: core: remove unused port_id fieldSergey Ryazanov
It was used initially for a port id allocation, then removed, and then accidently introduced again, but it is still unused. Drop it again to keep code clean. Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20260126062158.308598-2-slark_xiao@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30eth fbnic: Add debugfs hooks for tx/rx ringsMike Marciniszyn (Meta)
Add debugfs hooks to display tx/rx rings for each napi vector. Note that the cloning mechanism in fbnic_ethtool.c for configuration changes protects against concurrency issues with simultaneous config changes along with debugs ring accesses. The configuration switch builds up the new configuration offline, takes the current config down, which removes the debugfs nv files, and switches to the new configuration. The new configuration is brought up which brings the debugfs files back on top of the new configuration rings. The interaction with fbnic_queue_stop() and fbnic_queue_start() will similarly delete and add the files for the indicated vector. Signed-off-by: Mike Marciniszyn (Meta) <mike.marciniszyn@gmail.com> Link: https://patch.msgid.link/20260127200644.11640-3-mike.marciniszyn@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30eth fbnic: Add debugfs hooks for firmware mailboxMike Marciniszyn (Meta)
This patch adds reporting the Rx and Tx information interfacing with the firmware. The result of reading fbnic/fw_mbx is: Rx Rdy: 1 Head: 11 Tail: 10 Idx Len E Addr F H Raw ---------------------------------- 00 4096 0 000101fea000 0 1 1000000101fea001 01 4096 0 000101feb000 0 1 1000000101feb001 . . . 15 4096 0 000101fe9000 0 1 1000000101fe9001 Tx Rdy: 1 Head: 4 Tail: 4 Idx Len E Addr F H Raw ---------------------------------- 00 0004 1 00010321b000 1 1 000440010321b003 01 0004 1 00010228d000 1 1 000440010228d003 . . . 15 0004 1 00010321b000 1 1 000440010321b003 Signed-off-by: Mike Marciniszyn (Meta) <mike.marciniszyn@gmail.com> Link: https://patch.msgid.link/20260127200644.11640-2-mike.marciniszyn@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30net: usb: remove unnecessary get_drvinfo code and driver versionsEthan Nelson-Moore
Many USB network drivers define get_drvinfo functions which add no value over usbnet_get_drvinfo, only setting the driver name and version. usbnet_get_drvinfo automatically sets the driver name, and separate driver versions are now frowned upon in the kernel. Remove all driver versions and replace these get_drvinfo functions with references to usbnet_get_drvinfo where possible. Where that is not possible, remove unnecessary code to set the driver name. Also remove two unnecessary initializations from aqc111_get_drvinfo, an inaccurate comment in pegasus.c, and an unused macro in catc.c. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Peter Korsgaard <peter@korsgaard.com> (for dm9601.c) Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Link: https://patch.msgid.link/20260129042435.13395-2-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30net: stmmac: spelling correctionsSimon Horman
Correct spelling as flagged by codespell. Signed-off-by: Simon Horman <horms@kernel.org> Reviewed-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/20260129-stmmac-spell-v1-1-c7df9a96e482@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30macvlan: fix error recovery in macvlan_common_newlink()Eric Dumazet
valis provided a nice repro to crash the kernel: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link set up dev p1 ip link set up dev p2 ip link add mv0 link p2 type macvlan mode source ip link add invalid% link p2 type macvlan mode source macaddr add 00:00:00:00:00:20 ping -c1 -I p1 1.2.3.4 He also gave a very detailed analysis: <quote valis> The issue is triggered when a new macvlan link is created with MACVLAN_MODE_SOURCE mode and MACVLAN_MACADDR_ADD (or MACVLAN_MACADDR_SET) parameter, lower device already has a macvlan port and register_netdevice() called from macvlan_common_newlink() fails (e.g. because of the invalid link name). In this case macvlan_hash_add_source is called from macvlan_change_sources() / macvlan_common_newlink(): This adds a reference to vlan to the port's vlan_source_hash using macvlan_source_entry. vlan is a pointer to the priv data of the link that is being created. When register_netdevice() fails, the error is returned from macvlan_newlink() to rtnl_newlink_create(): if (ops->newlink) err = ops->newlink(dev, &params, extack); else err = register_netdevice(dev); if (err < 0) { free_netdev(dev); goto out; } and free_netdev() is called, causing a kvfree() on the struct net_device that is still referenced in the source entry attached to the lower device's macvlan port. Now all packets sent on the macvlan port with a matching source mac address will trigger a use-after-free in macvlan_forward_source(). </quote valis> With all that, my fix is to make sure we call macvlan_flush_sources() regardless of @create value whenever "goto destroy_macvlan_port;" path is taken. Many thanks to valis for following up on this issue. Fixes: aa5fd0fb7748 ("driver: macvlan: Destroy new macvlan port if macvlan_common_newlink failed.") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: valis <sec@valis.email> Reported-by: syzbot+7182fbe91e58602ec1fe@syzkaller.appspotmail.com Closes: https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u Cc: Boudewijn van der Heide <boudewijn@delta-utec.com> Link: https://patch.msgid.link/20260129204359.632556-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30amd-xgbe: add support for rx alignment errorsRaju Rangoju
Add the support to read the rx alignment errors and update them in the standard rtnl_link_stats64 structure. Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260129111520.1567097-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP moduleMarek Behún
Commit fd580c9830316eda ("net: sfp: augment SFP parsing with phy_interface_t bitmap") did not add augumentation for the interface bitmap in the quirk for Ubiquiti U-Fiber Instant. The subsequent commit f81fa96d8a6c7a77 ("net: phylink: use phy_interface_t bitmaps for optical modules") then changed phylink code for selection of SFP interface: instead of using link mode bitmap, the interface bitmap is used, and the fastest interface mode supported by both SFP module and MAC is chosen. Since the interface bitmap contains also modes faster than 1000base-x, this caused a regression wherein this module stopped working out-of-the-box. Fix this. Fixes: fd580c9830316eda ("net: sfp: augment SFP parsing with phy_interface_t bitmap") Signed-off-by: Marek Behún <kabel@kernel.org> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20260129082227.17443-1-kabel@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-30Merge tag 'for-linus-iommufd' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fix from Jason Gunthorpe: "One fix for a harmless KMSAN splat" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Initialize batch->kind in batch_clear()
2026-01-30Merge tag 'firewire-fixes-6.19-rc8' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "Fix a race condition introduced in v6.18. Andreas Persson discovered this issue while working with Focusrite Saffire Pro 40 (TCD33070). The fw_card instance maintains a linked list of pending transactions, which must be protected against concurrent access. However, a commit b5725cfa4120 ("firewire: core: use spin lock specific to timer for split transaction") unintentionally allowed concurrent accesses to this list. Fix this by adjusting the relevant critical sections to properly serialize access" * tag 'firewire-fixes-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: core: fix race condition against transaction list
2026-01-30Merge tag 'rust-fixes-6.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust fixes from Miguel Ojeda: "Toolchain and infrastructure: - Trigger rebuilds of the newly added 'proc-macro2' crate (and its dependencies) when the Rust compiler version changes - Fix error in '.rsi' targets (macro expanding single targets) under 'O=' pointing to an external (not subdir) folder - Fix off-by-one line number in 'rustdoc' KUnit tests - Add '-fdiagnostics-show-context' to GCC flags skipped by 'bindgen' - Clean objtool warning by adding one more 'noreturn' function - Clean 'libpin_init_internal.{so,dylib}' in 'mrproper' 'kernel' crate: - Fix build error when using expressions in formatting arguments - Mark 'num::Bounded::__new()' as unsafe and clean documentation accordingly - Always inline functions using 'build_assert' with arguments - Fix 'rusttest' build error providing the right 'isize_atomic_repr' type for the host 'macros' crate: - Fix 'rusttest' build error by ignoring example rust-analyzer: - Remove assertion that was not true for distributions like NixOS - Add missing dependency edges and fix editions for 'quote' and sysroot crates to provide correct IDE support DRM Tyr: - Fix build error by adding missing dependency on 'CONFIG_COMMON_CLK' Plus clean a few typos in docs and comments" * tag 'rust-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (28 commits) rust: num: bounded: clean __new documentation and comments scripts: generate_rust_analyzer: fix resolution of #[pin_data] macros drm/tyr: depend on `COMMON_CLK` to fix build error rust: sync: atomic: Provide stub for `rusttest` 32-bit hosts kbuild: rust: clean libpin_init_internal in mrproper rust: proc-macro2: rebuild if the version text changes rust: num: bounded: add missing comment for always inlined function rust: sync: refcount: always inline functions using build_assert with arguments rust: bits: always inline functions using build_assert with arguments scripts: generate_rust_analyzer: compile sysroot with correct edition scripts: generate_rust_analyzer: compile quote with correct edition scripts: generate_rust_analyzer: quote: treat `core` and `std` as dependencies scripts: generate_rust_analyzer: syn: treat `std` as a dependency scripts: generate_rust_analyzer: remove sysroot assertion rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target scripts: generate_rust_analyzer: Add pin_init_internal deps scripts: generate_rust_analyzer: Add pin_init -> compiler_builtins dep scripts: generate_rust_analyzer: Add compiler_builtins -> core dep rust: macros: ignore example with module parameters rust: num: bounded: mark __new as unsafe ...
2026-01-31drm/radeon: Make MSI address limit based on the device DMA limitVivian Wang
The radeon driver restricts the MSI message address for devices older than the BONAIR generation to 32-bit MSI addresses due to the former restrictions of the PCI/MSI code which only allowed either 32-bit or full 64-bit address range. This does not work on platforms which have a MSI doorbell address above the 32-bit boundary but do not support the full 64 bit address range. The PCI/MSI core converted this binary decision to a DMA_BIT_MASK() based decision, which allows to describe the device limitations precisely. Convert the driver to provide the exact DMA address limitations to the PCI/MSI core. That allows devices which do not support the full 64-bit address space to work on platforms which have a MSI doorbell address above the 32-bit limit as long as it is within the hardware's addressable range. [ tglx: Massage changelog ] Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Christian König <christian.koenig@amd.com> Link: https://patch.msgid.link/20260129-pci-msi-addr-mask-v4-3-70da998f2750@iscas.ac.cn
2026-01-31PCI/MSI: Check the device specific address mask in msi_verify_entries()Vivian Wang
Instead of a 32-bit/64-bit dichotomy, check the MSI address against the device specific address mask. This allows platforms with an MSI doorbell address above the 32-bit limit to work with devices without full 64-bit MSI address support, as long as the doorbell is within the addressable range of the device. [ tglx: Massaged changelog ] Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260129-pci-msi-addr-mask-v4-2-70da998f2750@iscas.ac.cn
2026-01-31PCI/MSI: Convert the boolean no_64bit_msi flag to a DMA address maskVivian Wang
Some PCI devices have PCI_MSI_FLAGS_64BIT in the MSI capability, but implement less than 64 address bits. This breaks on platforms where such a device is assigned an MSI address higher than what's supported. Currently, no_64bit_msi bit is set for these devices, meaning that only 32-bit MSI addresses are allowed for them. However, on some platforms the MSI doorbell address is above the 32-bit limit but within the addressable range of the device. As a first step to enable MSI on those combinations of devices and platforms, convert the boolean no_64bit_msi flag to a DMA mask and fixup the affected usage sites: - no_64bit_msi = 1 -> msi_addr_mask = DMA_BIT_MASK(32) - no_64bit_msi = 0 -> msi_addr_mask = DMA_BIT_MASK(64) - if (no_64bit_msi) -> if (msi_addr_mask < DMA_BIT_MASK(64)) Since no values other than DMA_BIT_MASK(32) and DMA_BIT_MASK(64) are used, this is functionally equivalent. This prepares for changing the binary decision between 32 and 64 bit to a DMA mask based decision which allows to support systems which have a DMA address space less than 64bit but a MSI doorbell address above the 32-bit limit. [ tglx: Massaged changelog ] Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Brett Creeley <brett.creeley@amd.com> # ionic Reviewed-by: Thomas Gleixner <tglx@kernel.org> Acked-by: Takashi Iwai <tiwai@suse.de> # sound Link: https://patch.msgid.link/20260129-pci-msi-addr-mask-v4-1-70da998f2750@iscas.ac.cn
2026-01-31rtc: s35390a: implement nvmem supportLorenz Brun
This RTC has one "free" register which can be used to store arbitrary data. Expose it as a nvmem resource in Linux. Signed-off-by: Lorenz Brun <lorenz@monogon.tech> Link: https://patch.msgid.link/20251223125728.346073-1-lorenz@monogon.tech Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-01-31rtc: loongson: Add Loongson-2K0300 supportBinbin Zhou
The Loongson-2K0300's rtc hardware design is similar to that of the Loongson-1B, but it does not support the alarm feature. Introduce `LOONGSON_RTC_ALARM_WORKAROUND`, which indicates a chip that does not support the alarm feature, and rewrite the related logic in `loongson_rtc_alarm_setting()`. Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Link: https://patch.msgid.link/abff68dda2fe6a6601a9e58b31e278d941297fce.1768616276.git.zhoubinbin@loongson.cn Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-01-31i3c: dw-i3c-master: fix SIR reject bit mapping for dynamic addressesAdrian Ng Ho Yin
The IBI_SIR_REQ_REJECT register is a 32-bit bitmap indexed by the dynamic address of each I3C slave. The DesignWare controller derives the bit index by folding the 7-bit dynamic address into a 5-bit value, using the sum of the lower 5 bits and the upper 2 bits, modulo 32. The current implementation incorrectly uses the device table index when updating the SIR reject mask, which can result in rejecting or accepting IBIs for the wrong device. Compute the SIR reject bit index directly from the dynamic address, as defined by the controller specification, and use it consistently when updating the reject mask. Signed-off-by: Adrian Ng Ho Yin <adrianhoyin.ng@altera.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/d4ad8161e604156c60327060ad3d339ebf18fe4f.1769479330.git.adrianhoyin.ng@altera.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-01-31i3c: dw-i3c-master: convert spinlock usage to scoped guardsAdrian Ng Ho Yin
Convert dw-i3c-master to use scoped spinlock guards in place of open-coded spin_lock_irqsave()/spin_unlock_irqrestore() pairs to ensure locks are always safely released on scope exit. Signed-off-by: Adrian Ng Ho Yin <adrianhoyin.ng@altera.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/79020c006c15dda9d057946530f16cfb4650d450.1769479330.git.adrianhoyin.ng@altera.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>