| Age | Commit message (Collapse) | Author |
|---|
|
|
|
The spinlocks in the fw_card structure protect transaction-related state
from concurrent access. They are acquired mostly from process context.
The exceptions are split_transaction_timeout_callback(), which runs in
softirq context for the timer wheel, and __fw_send_request(), which may
also be called from interrupt context.
Use spin_lock() in split_transaction_timeout_callback() and
spin_lock_irqsave() in the other functions. The latter preserves and
restores the caller's interrupt state, as the callers are not guaranteed
to have interrupts enabled.
Link: https://lore.kernel.org/r/20261012015739.530731-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
|
|
Commit afaf2ba5b430 ("mailbox: qcom-ipcc: Support interrupt wake up
from suspend") replaced enable_irq_wake() with IRQF_NO_SUSPEND on the
IRQ request, but left the paired disable_irq_wake() in remove()
behind.
disable_irq_wake() decrements the IRQ's wake_depth. With no matching
enable_irq_wake() left to increment it, wake_depth stays at 0 and
irq_set_irq_wake() reports:
WARN(1, "Unbalanced IRQ %d wake disable\n", irq)
on every unbind. Since there is no enable_irq_wake() to pair it with,
remove the stray disable_irq_wake() call; IRQF_NO_SUSPEND already
provides the intended wake behaviour.
Fixes: afaf2ba5b430 ("mailbox: qcom-ipcc: Support interrupt wake up from suspend")
Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
qcom_ipcc_probe() uses a function-static int id incremented with
plain id++ to generate unique IRQ names. Under async or deferred
probe, two instances can probe concurrently and read the same value
before either increments, producing duplicate IRQ names.
The device already has a unique name assigned by the platform bus. Use
dev_name(&pdev->dev) directly as the IRQ name. This eliminates the racy
counter, the name buffer, and the devm_kasprintf() allocation entirely,
while providing a more informative IRQ name in /proc/interrupts.
Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
qcom_ipcc_mbox_shutdown() clears chan->con_priv with no locking.
qcom_ipcc_mbox_send_data() dereferences the same field without
checking for NULL first, so a send racing a concurrent shutdown can
crash:
mchan = chan->con_priv;
...
hwirq = qcom_ipcc_get_hwirq(mchan->client_id, mchan->signal_id);
Add the same NULL guard mbox_send_message() already uses for
chan->cl, and bail out before dereferencing a cleared con_priv.
To close the remaining race where send_data() reads con_priv a moment
before a concurrent shutdown clears it, acquire the spinlock in
qcom_ipcc_mbox_shutdown() using the modern guard(spinlock_irqsave)
primitive before setting con_priv to NULL.
Fixes: d6fbfdbc1274 ("mailbox: qcom-ipcc: Fix IPCC mbox channel exhaustion")
Cc: stable@vger.kernel.org
Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
pm_runtime_get_sync() leaves the runtime PM usage counter incremented
even when it fails, but cmdq_mbox_flush() returns the error without
dropping it. The same happens when the GCE thread does not drain in
time and the function bails out with -EFAULT.
Undo the reference on both error paths.
Fixes: b0524f7c9635 ("mailbox: mediatek: implement flush function")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
bcm74110_rx_push_init_msg() allocates a GFP_ATOMIC struct for every
BCM_MSG_SVC_INIT word received from the PMC co-processor and appends it
to rx_svc_init_list with no cap on list length. The only consumers of
this list (bcm74110_rx_pop_init_msg_block / bcm74110_rx_flush_msg) are
called only during probe and at shutdown respectively; after probe
completes, PMC firmware can continuously inject BCM_MSG_SVC_INIT words,
exhausting GFP_ATOMIC reserves and causing a whole-device denial of
service.
Add BCM74110_INIT_MSG_MAX (16 entries) as the maximum list depth.
bcm74110_rx_push_init_msg() now checks the count under the existing
rx_svc_list_lock before allocating; if the cap is reached the message is
dropped and a rate-limited warning is emitted. The new rx_svc_init_count
field is decremented by bcm74110_rx_pop_init_msg() on successful dequeue
and reset to zero by bcm74110_rx_flush_msg() on shutdown.
Fixes: 52436007b862 ("mailbox: Add support for bcm74110")
Cc: stable@vger.kernel.org
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Assisted-by: Anthropic:claude-sonnet-4.6 cursor
Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
Acked-by: Justin Chen <justin.chen@broadcom.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
mhuv2_tx_init() waits forever for access_ready. Fail probe
after 1s instead of hanging boot.
Fixes: 5a6338cce9f4 ("mailbox: arm_mhuv2: Add driver")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
The RX polling callback unconditionally rearms the timer after it
processes mailbox data. altera_mbox_shutdown() uses
timer_delete_sync(), which waits for a running callback but does not
prevent that callback from rearming the timer after the deletion.
Use timer_shutdown_sync() for the final polling teardown so the timer
cannot be queued again while the mailbox channel is being released.
The timer is reinitialized with timer_setup() on a later channel startup,
so polling mode remains reusable.
Fixes: f62092f6d77d ("mailbox: Add Altera mailbox driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
Document the APCS mailbox compatible for the IPQ9650 SoC. IPQ9650 uses
qcom,msm8994-apcs-kpss-global as a fallback, so add the valid compatible
string combination to the binding.
Signed-off-by: Varadarajan Narayanan <varadarajan.narayanan@oss.qualcomm.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
Convert the hisilicon,hi6220-mbox binding to DT schema format. It's a
straight forward conversion.
Assisted-by: LLM
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
Convert the hisilicon,hi3660-mbox binding to DT schema format. The
binding and driver give no clue about what the 2 interrupts are, so more
details can't be added.
Assisted-by: LLM
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
ti_msgmgr_send_data() copies the message to the data registers in u32
units. This has been harmless so far because the clients (TI-SCI)
always passed its preallocated message buffer, which is sized to the
maximum message size (60 or 64 bytes, a multiple of 4), so the extra
bytes read were still within the buffer. But, with a later TI-SCI
update, the message size can be varying now and not guaranteed to be a
multiple of 4, which would trigger KASAN out-of-bounds reports.
Therefore, memcpy() only the trailing bytes into a zeroed u32 before
writing it to the register. This is at most 3 bytes, so the overhead
is negligible.
Fixes: aace66b170ce ("mailbox: Introduce TI message manager driver")
Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
Acked-by: Andrew Davis <afd@ti.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
In polled rx mode, used from system suspend until resume,
ti_msgmgr_send_data() writes the message to the tx queue and then
waits for the response. If no response arrives in time it returns
the poll error.
The mailbox core treats a ->send_data() error as a send failure.
So, it leaves the message queued without making it the active request,
and mbox_send_message() still returns success. The message is then
submitted again on the next tx_tick() or mbox_send_message(), after the
client has probably timed out and moved on. So, the firmware receives
the same message twice, and later requests are sent late and can have
responses matched to the wrong request.
The message has already been transmitted at this point, so return 0
and only log the missing response. The client detects this case with
its own response timeout anyways.
Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
Acked-by: Andrew Davis <afd@ti.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
When MHUv3 is used as the SCMI mailbox transport (arm,scmi-mailbox),
SCMI clock and power-domain operations still need to work in the noirq
phase of system suspend: genpd may power off a device's parent domain
from genpd_suspend_noirq(), which issues scmi_clock_config_set() /
scmi_power_state_set() and waits for the firmware reply via the mailbox
RX IRQ.
However, dpm_suspend_noirq() calls suspend_device_irqs() before running
the suspend_noirq callbacks, so the combined interrupts are already
masked at that point and the SCMI transfer times out while waiting for
the reply.
Both the PBX and MBX combined interrupts are requested as threaded
IRQs with only IRQF_ONESHOT. The MBX combined IRQ must stay enabled so
that firmware replies are delivered, and the PBX combined IRQ, used
for txdone by IRQ when not in polling mode, needs the same treatment.
IRQ threads are not frozen during system suspend, so with
IRQF_NO_SUSPEND the threaded combined-IRQ handlers still run in the
noirq phase.
Add IRQF_NO_SUSPEND to the MHUv3 combined IRQ registrations so that
SCMI remains functional throughout the suspend/resume cycle. Note that
this only keeps the IRQs functional during the suspend/resume cycle and
does not make the mailbox a wakeup source.
Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
failure
mhu_db_probe() registers the mailbox controller via
devm_mbox_controller_register(), which automatically calls
mbox_controller_unregister() through devres when the device is removed
or probe fails. If devm_request_threaded_irq() subsequently fails in
the channel setup loop, the error path also manually calls
mbox_controller_unregister(), resulting in a double call that corrupts
the global mailbox controller list and causes a kernel panic.
Remove the redundant manual call and rely on devres for cleanup.
Fixes: 7002ca237b21 ("mailbox: arm_mhu: Add ARM MHU doorbell driver")
Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
failure
qcom_ipcc_probe() registers the mailbox controller via
devm_mbox_controller_register(), which automatically calls
mbox_controller_unregister() through devres when the device is removed
or probe fails. If devm_request_irq() subsequently fails, the
err_req_irq: label also manually calls mbox_controller_unregister(),
resulting in a double call that corrupts the global mailbox controller
list and causes a kernel panic.
Remove the redundant manual call and rely on devres for cleanup.
Fixes: e9d50e4b4d04 ("mailbox: qcom-ipcc: Dynamic alloc for channel arrangement")
Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
Add the compatible for the APCS in the SDM670 SoC.
Signed-off-by: Richard Acayan <mailingradian@gmail.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
This is more compact in source code and also compiles to smaller code.
Bloat-o-meter reports:
add/remove: 0/0 grow/shrink: 0/4 up/down: 0/-76 (-76)
Function old new delta
rockchip_mbox_probe 1596 1592 -4
_entry_ptr 24 16 -8
__func__ 62 42 -20
_entry 132 88 -44
Total: Before=6693, After=6617, chg -1.14%
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
There is only a single device variant. Let's not use multi-device
abstraction for that but hardcode the information relevant for that
single device type.
Bloat-o-meter reports the following size reduction for an ARCH=arm64
build:
add/remove: 0/1 grow/shrink: 0/1 up/down: 0/-492 (-492)
Function old new delta
rk3368_drv_data 4 - -4
rockchip_mbox_probe 2084 1596 -488
Total: Before=7185, After=6693, chg -6.85%
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
This way the defines don't make the impression to be more generic than
they actually are.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
mbox_free_channel() makes a PCC channel available before the subsequent
shared-memory unmap. Without serialization, a concurrent request can bind a
new client and replace the mapping, which the old release then unmaps.
Serialize PCC channel acquisition and release. Keep the channel unavailable
until the old shared-memory mapping has been removed.
Suggested-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Christian Loehle <christian.loehle@arm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
I am seeing a crash on PCC that is related to a an shared memory being
unmapped before the IRQ is disabled, and the IRQ kicks in and hits the
unmapped (NULL) address. This is a summary of what I see on my box:
scmi_protocol scmi_dev.1: Message for 1 type 0 is not expected!
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004
__handle_irq_event_percpu+0x1c4/0x9e0
handle_irq_event+0x98/0x218
handle_fasteoi_irq+0x230/0x750
generic_handle_domain_irq+0xac/0x138
gic_handle_irq+0x344/0x740
call_on_irq_stack+0x30/0x48
The trapping store is iowrite32(SCMI_SHMEM_FLAG_INTR_ENABLED,
&shmem->header.flags), a write of 1 at offset 4 of a NULL base.
But, back to the problem, pcc_mbox_free_channel() unmaps the shared
memory and clears pchan->chan.shmem *before* freeing the IRQ (aka
calling mbox_free_channel()).
The interrupt is still live when the mapping goes away.
Free the channel first, before the memory unmap. mbox_free_channel()
calls pcc_shutdown(), which frees the platform interrupt, and then unmap
shared memory.
Fixes: 7f9e19f207be ("mailbox: pcc: Check before sending MCTP PCC response ACK")
Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
Add support for the TDA54 secure proxy mailbox controller integrated in
the MAIN voltage domain. This instance supports up to 444 threads with
60-byte messages per thread. Add the corresponding device data for the
ti,tda54-main-secure-proxy compatible.
While at it, update some internal variable types from u8 to u16 to hold
values up to 444.
Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
Add the ti,tda54-main-secure-proxy compatible for the secure proxy
mailbox controller integrated in the MAIN voltage domain of the TI TDA54
SoC, which features up to 444 threads with 60-byte messages per
thread.
The number of threads is fixed at SoC integration and cannot be
discovered at runtime, therefore a separate compatible is needed.
Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
kernel test robot reported a format-truncation warning for the
snprintf() that builds each channel's debugfs entry name:
drivers/mailbox/axiado-mailbox.c:325:39: warning: '-errors'
directive output may be truncated writing 7 bytes into a region
of size between 2 and 11 [-Wformat-truncation=]
AX3005 exposes 16 mailbox channels, so the longest name generated at
runtime is "chan15-errors" and already fits in the original buffer.
However, the compiler cannot infer that bound from
drv_data->num_chans and therefore assumes the unsigned channel index
may require up to 10 decimal digits. Widen the buffer to 32 bytes,
which removes the -Wformat-truncation warning with no functional
change.
Fixes: 14af7a96afa3 ("mailbox: add Axiado AX3005 mailbox driver")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202608250447.gGkRwNAl-lkp@intel.com/
Signed-off-by: Swark Yang <syang@axiado.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
Two RX-path bugs found during bring-up:
1. axiado_rx_thread() previously consumed only one frame per
invocation. Multiple frames can accumulate in the FIFO while the
threaded handler is running. Split the single-frame handling into
axiado_mbox_receive_one_frame() and drain all currently queued
frames before returning from the handler. A cond_resched() in the
drain loop prevents a continuously-fed channel from monopolizing
the CPU.
2. readl_poll_timeout() waiting for the remainder of a frame can
return success either because the required FIFO level was reached
or because a FIFO error appeared -- it does not distinguish the
two. The old code did not check for that case and could therefore
enter the read loop without enough words actually being present.
Explicitly inspect the error status after the poll: if an error
occurs while waiting for the remainder of an already-started
frame, treat that frame as unusable and flush the FIFO to
resynchronize, rather than risk delivering incomplete or garbage
data to the client.
While here:
- Track whether the handler actually serviced a hardware condition,
such as clearing a FIFO error or consuming frame data. Return
IRQ_HANDLED whenever something was serviced, even if the FIFO is
empty afterward, instead of reporting IRQ_NONE after handling a
hardware condition.
- Use readsl() for the RX FIFO payload. The destination is the
driver-owned rx_buffer allocated by devm_kzalloc(), so it has
suitable alignment for the stream accessor. readsl() is
appropriate for copying a sequence of words from the FIFO into
that buffer. The TX path intentionally stays on
get_unaligned_le32()/writel(): its buffer is supplied by an
external mailbox client, the mailbox API gives no guarantee that
buffer is naturally aligned, and the TX path also explicitly
handles a partial final word.
mbox_free_channel() invokes ->shutdown() before chan->cl is cleared,
and axiado_mbox_shutdown() calls disable_irq(), which waits for the
in-flight threaded handler to complete, so no functional change is
needed for that path.
Verified: builds clean with the aarch64 cross-compiler, passes
checkpatch.pl, and was regression-tested with live mailbox traffic on
AX3005.
Fixes: 14af7a96afa3 ("mailbox: add Axiado AX3005 mailbox driver")
Signed-off-by: Swark Yang <syang@axiado.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
|
|
`#[pin_data]` inserts outlive bounds between lifetimes to allow closure
callbacks to rely on their relationship. In some cases, these relations are
implied by fields, and Rust generates `explicit_outlives_requirements`
allow-by-default lint, which is turned out by kernel as part of
rust-2018-idioms lint group.
As `#[pin_data]` is a proc macro and it cannot know if the bounds are
already implied, suppress such lints for generated code.
Link: https://patch.msgid.link/20261011133904.600785-1-gary@kernel.org
Signed-off-by: Gary Guo <gary@garyguo.net>
|
|
https://gitlab.freedesktop.org/drm/msm into drm-next
Changes for v7.4
CI:
- Dropped sc7180 trogdor lazor from the CI
Core:
- Fixed msm_ioremap for resources without a name
- Changed msm.separate_gpu_kms to default to auto selection
GPU:
- Enable CLX (Current Limit eXtension) for gen8 to avoid
exceeding limits on CX/GX rails
- New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi),
x2-85 (Mahua)
- Fix VBIF halt mask on a306, which was preventing runpm
suspend
- Enable THP support for GEM buffers
- Add modparam to disable waiting on fences in shrinker
- Drop use of drm_prime_sg_to_page_array()
- a5xx: don't read the GPMU registers on GPUs without a GPMU
- a2xx/a3xx/a5xx: hangcheck progress detection
- a6xx: gmuwrapper runpm fix
- Calculate reported GMEM size based on active slices
- Split a6xx/a7xx/a8xx catalog
DP:
- Picked up some preparation patches for the MST support
- Fixed reported status of the link training
DPU:
- Fixed CRTC bandwidth computation
- Fixed DSC programming
- Fixed encoder disablement path
DSI:
- Fixed VM leak in error path
- Indention fix
MDP5:
- Added MSM8952 configuration
- Dropped incorrect cursor pipe on MSM8976/56
HDMI:
- Small fixes
Notes:
- Merged qcom-drivers-for-7.4 to pick up UBWC_7_0 support
(needed for Hawi/Maili) which in turn depended on
qcom-arm64-for-7.4
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Rob Clark <rob.clark@oss.qualcomm.com>
Link: https://patch.msgid.link/CACSVV02V-FOzGj71G0ZL7khkYEKWFW4q4biOZR8B8vyWy20PdQ@mail.gmail.com
|
|
Add DRM_FORMAT_HOST_ARGB8888 to the list of supported formats for
virtio-gpu primary planes. Without this, glmark2-drm fails at
startup because it selects ARGB visual configs by default, which
don't match the XRGB-only plane capabilities. This causes
drmModeSetCrtc to fail with EINVAL.
The virtio_gpu_translate_format() function already handles
ARGB8888 translation to VIRTIO_GPU_FORMAT_B8G8R8A8_UNORM,
so this just exposes the existing capability to userspace.
Signed-off-by: Dorinda Bassey <dbassey@redhat.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Link: https://patch.msgid.link/20260930132707.500748-1-dbassey@redhat.com
|
|
The cursor blending mode was added twice because the same change was
applied by accident from different patches. Revert the second patch.
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/dri-devel/ce84d3d2-e78b-4939-aecf-9ef7267bd42a@samsung.com/
Fixes: 6947b78df4d2 ("drm/virtio: Add pixel blend mode property to cursor plane")
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://patch.msgid.link/20261007222244.295186-1-dmitry.osipenko@collabora.com
|
|
br_netfilter has way too many bugs, schedule for removal and disable
the feature in user namespaces.
In particular, we get more and more gadgets to have bridge ports escape
rcu_read_lock() protection, then underlying device gets reconfigured
(macvlan or something else), then reinject into network stack causes
crash because net_device is assumed to still have bridge rx data
associated with it.
br_netfilter is an ancient kludge that emulates ip stack from within the
bridge and then calls into ipv4/ipv6 netfilter hooks to have bridged
frames processed via iptables/ip6tables by setting the 'call-iptables'
sysctls to 1. It is NOT related to ebtables or nftables 'bridge' family
at all.
Note that in addition to call-iptables, sysctls, the bridge also exposes
call-iptables per bridge device via netlink and sysfs
('BROPT_NF_CALL_IPTABLES') toggles.
Those are still available, the brnet structure is scoped to br_netfilter;
exposing it bridge-wide is a big no-no.
This relies on brnf_device_event() no longer registering the base
br_netfilter hooks, so while BROPT_NF_CALL_IPTABLES can be set, it
has no effect because the hooks that evaluate this feature bit
are never registered.
brnf_init_net can no longer depend on CONFIG_SYSCTL, else such builds
never disable support in user namespaces.
Cc: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
The LCPA area is mapped with devm_ioremap(), but lcpa_base and the
per-channel lcpa pointer lack __iomem annotations. This loses the I/O
address space and makes sparse warn when d40_current_addr() assigns
LCPA register addresses to its __iomem pointers.
Annotate both pointers and the LCPA argument of d40_log_lli_lcpa_write()
to preserve the I/O address space from the mapping to the register
accessors. This also fixes the existing LCPA read and write warnings
without changing the generated code.
Fixes: c80edceff29e ("dmaengine: ste_dma40: Fix cyclic transfer residue")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202610090216.pjMRxhRL-lkp@intel.com/
Assisted-by: LLM
Signed-off-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20261010-dma40-smatch-fix-v1-1-26ca10043957@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
Sashiko pointed in [1] about the cookie completion order. It is good to
Document that for ensuring that dma buffer is flushed and no stale data
is seeing by consumer, we need to make sure such action is taken before
drivers invoke dma cookie completion.
[1]: https://lore.kernel.org/r/20260917072507.5BDB61F000FF@smtp.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://patch.msgid.link/20261009093745.539924-1-vkoul@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux
Pull Landlock fix from Mickaël Salaün:
"This fixes a Clang bug by removing an annotation, which was introduced
mostly for documentation"
* tag 'landlock-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:
landlock: Drop __counted_by from landlock_domain.handled_masks
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A small collection of driver specific fixes, plus a new device ID in
the DesignWare device tree binding.
One of the sg2044 fixes which enforces clock limits properly is more
critical than average since getting them wrong might lead to data
corruption"
* tag 'spi-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi
spi: sg2044-nor: Honor SPI clock limits
spi: sg2044-nor: Return transfer errors
spi: cadence-qspi: Fix status polling with octal DTR chips
spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown:
"There's a couple of core fixes here: there were a couple of issues
with of_regulator_bulk_get_all() not behaving consistently with the
other bulk regulator APIs which caused memory leaks and error handling
issues in users.
We also have a couple of fairly standard driver specific fixes"
* tag 'regulator-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
regulator: of: state who owns the array from of_regulator_bulk_get_all()
regulator: of: fill in supply names in of_regulator_bulk_get_all()
regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
|
|
Add a MAINTAINERS entry for the Rust `bug` module, which currently
provides the `warn_on!` macro.
Suggested-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Link: https://patch.msgid.link/20261004124211.381401-1-tomo@flapping.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
|
|
https://github.com/Rust-for-Linux/linux into rust-next
Pull timekeeping updates from Andreas Hindborg:
- Warn and assert when passing out-of-range inputs to 'fsleep' and
'udelay'.
- Rename 'ClockSource' to 'ClockId' to better align with naming
conventions in C kernel.
- Make 'CONFIG_HZ' value available as 'bindings::HZ'.
- Add a conversion method to convert 'Delta' to 'jiffies' for use in
timeout arguments.
- Add implementation detail documentation for 'HrTimer'.
* tag 'rust-timekeeping-for-v7.4-rc1' of https://github.com/Rust-for-Linux/linux:
rust: hrtimer: document handle based design rationale
rust: time: add Delta::to_jiffies_timeout() for timeout conversion
rust: bindings: set HZ to CONFIG_HZ
rust: time: rename ClockSource trait to ClockId
rust: time: warn and assert out-of-range input in fsleep() and udelay()
|
|
rust-next
Pull alloc updates from Danilo Krummrich:
- Add Alice Ryhl as co-maintainer for Rust [ALLOC]
- Allow different error types in KBox::pin_slice(), enabling use of
infallible initializers
- Add NumaNode::id() accessor to retrieve the underlying NUMA node
identifier
* tag 'alloc-7.4-rc1' of https://github.com/Rust-for-Linux/linux:
rust: alloc: add `NumaNode::id()` accessor
rust: alloc: allow different error types in `KBox::pin_slice`
MAINTAINERS: add Alice Ryhl as co-maintainer for Rust [ALLOC]
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"Driver (and tape media changer) only fixes. Three of the fixes are
about the same size, (ch, ufs decouble CQ and ufs avoid unsafe MMIO)
but the unsafe MMIO is the least obvious logic change"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ
scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()
scsi: ch: Do not keep references to data transfer element devices
scsi: ufs: mediatek: Handle mPHY power-on failures
scsi: qedi: Initialize callback state before registration
scsi: ufs: core: Hold a clock reference across the probe
|
|
When an MHI endpoint device runs Linux, there is no firmware to implement
the LOOPBACK channel echo that real modem firmware provides. Without an
endpoint-side driver, the host loopback test has no software echo partner
and cannot exercise the full end-to-end MHI data path.
Add an endpoint-side loopback driver that binds to the LOOPBACK channel and
echoes received data back to the host. An ordered workqueue is used for
asynchronous processing to preserve packet ordering. Together with the
host-side loopback driver, this enables complete MHI data path validation
for Linux-based endpoint devices.
Co-developed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
Signed-off-by: Sumit Kumar <sumit.kumar@oss.qualcomm.com>
Link: https://patch.msgid.link/20261005-lb-v7-3-36a268b6386f@oss.qualcomm.com
[mani: fixed checkpatch warnings]
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
|
|
Some MHI endpoint clients do not use socket buffers and need a way to queue
raw buffers for DL transfers. Add mhi_ep_queue_buf() to support this use
case.
Refactor mhi_ep_queue_skb() to delegate to a new internal mhi_ep_queue()
helper shared by both APIs, and rename mhi_ep_skb_completion() to
mhi_ep_buf_completion() to reflect its broader use.
Signed-off-by: Sumit Kumar <sumit.kumar@oss.qualcomm.com>
Link: https://patch.msgid.link/20261005-lb-v7-2-36a268b6386f@oss.qualcomm.com
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
|
|
The MHI specification defines a LOOPBACK channel. The endpoint firmware
echoes back whatever the host sends on this channel. Without a host-side
driver, there is no way to exercise this channel to validate MHI data path
integrity between host and endpoint.
Add a host-side loopback driver that binds to the LOOPBACK channel and
expose a sysfs interface for data path testing. The sysfs interface allows
users to configure TRE buffer size and count, trigger a loopback test, and
read the result.
The new sysfs ABI is documented under Documentation/ABI/testing/, not
stable/, since this is a new interface without established API
guarantees yet. It is unrelated to the existing stable MHI sysfs ABI
documented in Documentation/ABI/stable/sysfs-bus-mhi, despite both
being covered by the same MAINTAINERS entry.
Co-developed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
Signed-off-by: Sumit Kumar <sumit.kumar@oss.qualcomm.com>
Link: https://patch.msgid.link/20261005-lb-v7-1-36a268b6386f@oss.qualcomm.com
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
|
|
The Quectel RM500Q-AE (SDX55) enumerates with the Qualcomm SDX55 ID
17cb:0306 and subsystem ID 17cb:5002, so it binds to the generic
qcom-sdx55m entry. That configuration expects QMI on channels 14/15,
which this module's firmware does not answer: the modem probes, but
every QMI request over the control channel times out and no data
session can be set up. Users of this module have had to fall back to
Quectel's out-of-tree driver.
Like the other Quectel modules, the RM500Q-AE provides MBIM control on
channels 12/13 and data on IP_HW0_MBIM. Add an entry for its subsystem
ID, which no other entry in the table uses, that reuses the Quectel
em1xx channel configuration. The EDL image name is the one the generic
SDX55 entry already uses.
Tested on a Xunison Exigo D50 5G (IPQ5018) with modem firmware
RM500QAEAAR13A03M4G: the modem probes as quectel-rm500q and exposes
wwan0mbim0, wwan0at0 and an MBIM network device. A data session set up
with mbimcli and with OpenWrt's umbim reached 160-180 Mbps, the
limit of the cell.
Assisted-by: LLM
Signed-off-by: Steve Meek <stevemeek82@gmail.com>
Link: https://patch.msgid.link/20261011-mhi-next-v1-1-13a738637ff0@gmail.com
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- NVMe fixes via Keith:
- Fix swapped ZRASF zone state values for full and read only
- nvme-multipath revalidate head zones after unfreezing the head
queue
- Revert "nvme: do not reset controllers in NVME_CTRL_NEW state",
which broke things
- nvmet fixes for invalid NSIDs on feature 82h and using the local
P2P device on metadata allocation failure
- zloop: zero out only the unread tail of a short read
* tag 'block-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
Revert "nvme: do not reset controllers in NVME_CTRL_NEW state"
zloop: zero out only the unread tail of short reads
nvmet: use the local P2P device on metadata allocation failure
nvme-multipath: revalidate head zones after unfreezing the head queue
nvme: fix swapped ZRASF zone state values for full and read only
nvmet: return Invalid Field for invalid NSIDs feature 82h
|
|
With clang 22 and CONFIG_FORTIFY_SOURCE, the second
landlock_restrict_self() call hits a bogus fortify report in
inherit_ruleset():
memcpy: detected buffer overflow: 4 byte write of buffer size 0
Call Trace:
__fortify_panic
landlock_merge_ruleset
__se_sys_landlock_restrict_self
handled_masks[] lives in an anonymous struct inside the anonymous union
that overlays work_free. For such a flexible array, clang computes the
address of the __counted_by counter as the start of the array instead of
&num_layers. The bound is then read from handled_masks[0], i.e. from
the first layer's access masks, which is not a count. The same layout
crashes clang itself in a standalone test.
The annotation was added as documentation, so drop it rather than
restructure the union. Keep the information in the member comment.
Reported-by: syzbot+a0eecb22de4d821a9e5d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a0eecb22de4d821a9e5d
Fixes: bd3a19800dd1 ("landlock: Add counted_by in landlock_domain")
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Link: https://lore.kernel.org/r/20261010164450.194439-1-ngocthang2710.1999@gmail.com
Reviewed-by: Günther Noack <gnoack3000@gmail.com>
Reported-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reported-by: Mike Bommarito <michael.bommarito@gmail.com>
Closes: https://lore.kernel.org/r/20261009115108.17819-1-michael.bommarito@gmail.com
[mic: Rebased on master, where the array is handled_masks[], updated the
fortify report, added the clang bug link and the other reports]
Signed-off-by: Mickaël Salaün <mic@digikod.net>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- Don't spin on local work the exiting task can't run.
For a ring still R_DISABLED when the task got its tctx node, the
submitter is set later and may be another task, so DEFER_TASKRUN
local work stays pending forever and the exiting task spins in
do_exit().
- Don't charge the SQ/CQ rings or provided buffer rings to
RLIMIT_MEMLOCK. The region API conversion started charging them,
which the rings had been exempt from.
- Don't exempt disabled rings from task restrictions on register
- Populate the CONNECT filter fields for a 24-byte sockaddr_in6
* tag 'io_uring-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/cancel: don't spin on local work the task can't run
io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
io_uring/register: don't exempt disabled rings from task restrictions
io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK
io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK
|
|
Pull xfs fixes from Carlos Maiolino:
"This fixes a data corruption vector where a user could trick the
exchange-range feature to add shared blocks beyond the file's EOF,
which may then be used to modify data on another file"
* tag 'xfs-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
xfs: fix exchange-range-to-eof file size exchange
xfs: stop exchanging reflink flags when exchanging mappings
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fix from Ingo Molnar:
- Work around AMD TLBI Erratum #1718 (Borislav Petkov)
* tag 'x86-urgent-2026-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/CPU/AMD: Fix AMD TLBI Erratum #1718
|
