summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-08-05dinghai: add hardware register access and PCI capability scanningJunyang Han
Implement PCI configuration space access, BAR mapping, capability scanning (common/notify/device), and hardware queue register definitions for DingHai PF device. Signed-off-by: Junyang Han <han.junyang@zte.com.cn> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05dinghai: add ZTE network driver supportJunyang Han
Add basic framework for ZTE DingHai ethernet PF driver, including Kconfig/Makefile build support and PCIe device probe/remove skeleton. Signed-off-by: Junyang Han <han.junyang@zte.com.cn> Link: https://patch.msgid.link/202608021621043761zZMwCny1e6y0TRFLQHxx@zte.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05ptp: reject frequency adjustments that overflow scaled_ppm_to_ppb()Deep Shah
ptp_clock_adjtime() validates an ADJ_FREQUENCY request by converting the requested scaled ppm to ppb and comparing it against ops->max_adj: long ppb = scaled_ppm_to_ppb(tx->freq); if (ppb > ops->max_adj || ppb < -ops->max_adj) return -ERANGE; scaled_ppm_to_ppb() computes (1 + ppm) * 125 >> 13 in s64. For a sufficiently large tx->freq the multiplication overflows s64 and wraps, so the resulting ppb can fall back within [-max_adj, max_adj] and pass the check. The unclamped tx->freq is then handed to ->adjfine(), where drivers scale it again (e.g. scaled_ppm * 762939453125 in ptp_idt82p33) and program a bogus frequency word. For example tx->freq = 147573952589676412 makes (1 + ppm) * 125 equal 2^64 + 9, which wraps to ppb == 0 and is accepted. The caller already has write access to the PHC, so this hardens the max_adj sanity check rather than crossing a privilege boundary, and well-behaved user space (e.g. ptp4l) never requests such values. It is a follow-up to commit 475b92f93216 ("ptp: improve max_adj check against unreasonable values"), which handled the analogous s32 narrowing but not this multiplication overflow. Detect the overflow with check_*_overflow() and reject the request in ptp_clock_adjtime() instead of acting on the wrapped value. Signed-off-by: Deep Shah <deepshah146@gmail.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Acked-by: Richard Cochran <richardcochran@gmail.com> Link: https://patch.msgid.link/20260801222923.39017-2-deepshah146@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05net: usb: cdc_ether: add quirk for AMI BMC stale link eventsJinhui Guo
On AMD Genoa/Turin platforms the BMC-provided USB-Ethernet gadget (American Megatrends, VID 0x046b PID 0xffb0) intermittently fails to respond to ARP after AC cold boot. usbmon captures a stale NETWORK_CONNECTION(off) immediately followed by NETWORK_CONNECTION(on) on the interrupt endpoint (~130us apart) after enumeration. Because alloc_netdev() leaves __LINK_STATE_NOCARRIER cleared, netif_carrier_ok() returns true when the spurious OFF arrives, so usbnet_cdc_status() cannot recognise it as redundant and schedules EVENT_LINK_CHANGE. __handle_link_change() then calls unlink_urbs(), killing ~60 rx URBs whose payload has already been DMA'd into memory — xHCI trace confirms them completing as -ECONNRESET with non-zero residual length. rx_complete() drops these unconditionally. The following ON restores the carrier and re-submits URBs, but the ARP reply is already lost; the interface looks "up but silent" until ifdown/ifup. Fix this by adding a device-specific quirk with FLAG_LINK_INTR set, which makes usbnet_probe() call netif_carrier_off() after bind. With initial carrier == OFF, usbnet_cdc_status() recognises the spurious OFF as matching the current state and drops it; the subsequent ON is the first real event and brings the link up cleanly without ever tearing down the rx queue. The scheduled link-change kevent is harmless because EVENT_DEV_OPEN is not yet set at probe time. This is applied as a device-specific quirk rather than a change to the shared cdc_info driver_info because some CDC devices never send NETWORK_CONNECTION notifications; forcing carrier off for them would leave the link permanently DOWN. Restricting the change to this VID/PID keeps that class of device untouched. Tested on Genoa and Turin across 100+ AC cold boot cycles; ping first-packet success rate went from intermittent to 100%. Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com> Link: https://patch.msgid.link/20260730051341.24930-1-guojinhui.liam@bytedance.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05pds_core: add debugfs support for host backed memoryNikhil P. Rao
Add debugfs entry to dump host backed memory allocations for debug purposes. Signed-off-by: Vamsi Atluri <Vamsi.Atluri@amd.com> Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com> Link: https://patch.msgid.link/20260730-upstream_v8-v12-6-136cd174ee85@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05pds_core: add host backed memory support for firmwareNikhil P. Rao
Some newer AMD/Pensando cards have minimal memory and there are cases where components, specifically in the control plane, need more memory. This series adds support for host backed DMA memory that can be used by the firmware for the previously mentioned cases. Host memory allocation is best-effort: if some allocations fail, the driver continues with whatever succeeded. Firmware gracefully degrades when less memory is available than requested. Signed-off-by: Vamsi Atluri <Vamsi.Atluri@amd.com> Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com> Link: https://patch.msgid.link/20260730-upstream_v8-v12-5-136cd174ee85@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05pds_core: add PLDM component info displayBrett Creeley
Add detailed component information display via devlink info. This allows users to see individual firmware components and their versions. Components are reported as fixed, running, or stored based on their firmware-provided flags. Example output: $ devlink dev info pci/0000:00:05.0 versions: fixed: asic.id 0x0 asic.rev 0x0 running: fw.bootloader 1.2.3 fw.uboot 1.60.0-73 fw 1.60.0-73 fw.cpld 3.18 stored: fw.bootloader 1.2.3 fw.uboot 1.60.0-73 fw.uboot.gold 1.50.0-22 fw.gold 1.50.0-22 fw 1.60.0-73 fw.cpld 3.18 Signed-off-by: Brett Creeley <brett.creeley@amd.com> Link: https://patch.msgid.link/20260730-upstream_v8-v12-4-136cd174ee85@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05pds_core: add PLDM firmware update support via devlink flashBrett Creeley
Implement PLDM FW Update in the pds_core driver using the upstream pldmfw API. This allows updating an entire PLDM FW package at once or updating specific firmware components by name. Flash the entire image: devlink dev flash pci/0000:b5:00.0 file firmware.pldmfw Flash a specific component from the PLDM FW package: devlink dev flash pci/0000:b5:00.0 \ file firmware.pldmfw component fw.cpld Per-component update uses driver-defined component names (fw, fw.cpld, etc.). Not all components support per-component update - devlink will reject the request if the specified component cannot be updated. Signed-off-by: Brett Creeley <brett.creeley@amd.com> Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com> Link: https://patch.msgid.link/20260730-upstream_v8-v12-3-136cd174ee85@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05pds_core: add support for identity version 2Brett Creeley
Add a new capabilities field in struct pds_core_dev_identity, which requires bumping the identity version to 2, i.e. PDS_CORE_IDENTITY_VERSION_2. If version 2 negotiation fails, then quietly fall back to version 1. If version 1 negotiation fails, then driver load will fail. Another patch in the series will make use of the capabilities field. Signed-off-by: Brett Creeley <brett.creeley@amd.com> Link: https://patch.msgid.link/20260730-upstream_v8-v12-2-136cd174ee85@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05pds_core: add support for quiet devcmd failuresBrett Creeley
Currently there aren't any use-cases that require special handling on whether or not to print devcmd failures. Specifically non-generic failures, i.e. not supported failures. Add support to allow these messages to be suppressed. This will be used when adding support to negotiate PDS_CORE_IDENTITY_VERSION_2. Signed-off-by: Brett Creeley <brett.creeley@amd.com> Link: https://patch.msgid.link/20260730-upstream_v8-v12-1-136cd174ee85@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05net: phy: nxp-tja11xx: cancel registration work on removeHongyan Xu
tja1102_p0_probe() schedules work to register the second port. That work uses the Port 0 private data and phydev. The private data is devm-allocated, but the driver does not wait for the pending work on remove. Store the Port 0 private data in phydev->priv and add a remove callback. The callback cancels the registration work before devres teardown frees the state. This issue was found by a static analysis tool. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn> Link: https://patch.msgid.link/20260801140643.1871-1-getshell@seu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05pfcp: Support per-netns netdev unregistration.Kuniyuki Iwashima
pfcp_net_exit_rtnl() iterates pfcp devices whose sockets are in the dying netns and queues them for destruction. So the devices may reside in different netns. Let's use unregister_netdevice_queue_net() to support per-netns device unregistration. list_del() is changed to list_del_init() to avoid queueing the same device twice. Even after pfcp_net_exit_rtnl() queues a cross-netns pfcp device, pfcp_dellink() could be called concurrently for it (once RTNL is removed). In such a case, __rtnl_net_unlock() will perform the unregistration. We can see pfcp0 below is unregistered by the per-netns work instead of cleanup_net(). # bpftrace -e '#include <linux/netdevice.h> kprobe:pfcp_dev_uninit { $dev = (struct net_device *)arg0; printf("PID: %d | DEV: %s%s\n", pid, $dev->name, kstack()); } kprobe:pfcp_net_exit_rtnl { printf("PID: %d%s\n", pid, kstack()); }' & # ip netns add ns1 # ip netns add ns2 # ip -n ns1 link add pfcp0 link-netns ns2 type pfcp # ip netns del ns2 PID: 12 pfcp_net_exit_rtnl+5 ops_undo_list+702 cleanup_net+1122 process_scheduled_works+2538 ... PID: 462 | DEV: pfcp0 pfcp_dev_uninit+5 unregister_netdevice_many_notify+7129 unregister_netdevice_many_net+1050 rtnl_net_work_func+136 process_scheduled_works+2538 Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260731224406.2444121-3-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05pfcp: Protect pfcp_net.pfcp_dev_list with mutex.Kuniyuki Iwashima
struct pfcp_dev.net is the netns where the backend pfcp socket resides. struct pfcp_dev is linked to the pfcp_net.pfcp_dev_list of the socket's netns. During netns dismantle or module unload, pfcp_net_exit_rtnl() iterates the list and queues devices for destruction regardless of the devices' netns. Thus, once RTNL is removed, the list can be modified concurrently from different netns due to device removal. Let's protect it with per-netns mutex. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260731224406.2444121-2-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05dibs: initialise dibs->lock in dibs_dev_alloc()Hidayath Khan
dibs->lock is initialised by dibs_dev_add(), but a dibs device can already take interrupts before that call: ism_probe() runs ism_dev_init(), and hence request_irq(), before it calls dibs_dev_add(). No client can have registered a dmb at that point, so no dmb interrupt can occur, but a GID event interrupt can, and ism_handle_irq() takes dibs->lock unconditionally on entry, before it inspects anything else. Initialise the lock in dibs_dev_alloc() instead, so that it is valid as soon as a driver can publish the device to its interrupt handler. Fixes: cc21191b584c ("dibs: Move data path to dibs layer") Cc: stable@vger.kernel.org Reviewed-by: Alexandra Winter <wintera@linux.ibm.com> Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com> Link: https://patch.msgid.link/20260730124227.167829-1-hidayath@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05net: prestera: validate firmware header lengthPengpeng Hou
prestera_fw_hdr_parse() reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struct prestera_fw_header before decoding the magic and version fields. Fixes: 4c2703dfd7fabb ("net: marvell: prestera: Add PCI interface support") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Acked-by: Elad Nachman <enachman@marvell.com> Link: https://patch.msgid.link/20260731141500.1-prestera-v2-pengpeng@iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()Dongli Zhang
The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb->dev. Without the assignment, a NULL pointer dereference can occur. However, tap_get_user_xdp() still parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev is still NULL, resulting in a crash. Fix this by looking up the tap device and assigning skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit(). Fixes: 924a9bc362a5 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct") Cc: stable@vger.kernel.org Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Link: https://patch.msgid.link/20260802224612.264563-1-dongli.zhang@oracle.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05qlcnic: drop unneeded semicolonJulia Lawall
When a function-like macro expands to an expression, that expression doesn't need a semicolon after it. All uses have been verified to have their own semicolons. This was found using the following Coccinelle semantic patch: @r@ identifier i : script:ocaml() { String.lowercase_ascii i = i }; expression e; @@ *#define i(...) e; Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> Link: https://patch.msgid.link/20260801191002.1383835-5-Julia.Lawall@inria.fr Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05net: macb: remove unused ENST Q0/Q1 time register definesVineeth Karumanchi
The ENST start/on/off time register definitions for Q0 and Q1 are not referenced anywhere in the driver. The driver calculates these register addresses from the ENST base offset and the queue index instead of using fixed defines, removing the unused macros. Signed-off-by: Vineeth Karumanchi <vineeth.karumanchi@amd.com> Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Reviewed-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260803062834.3865755-1-vineeth.karumanchi@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06gpu: nova-core: update firmware module info for TLV imagesTimur Tabi
Now that nova-core loads the TLV firmware images, update the firmware module info to specify those files. Also remove FIRMWARE_VERSION as it is no longer used. Signed-off-by: Timur Tabi <ttabi@nvidia.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Tested-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://patch.msgid.link/20260731201017.2580713-9-ttabi@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-08-06gpu: nova-core: transition fsp to TLV imagesTimur Tabi
Switch the FSP firmware loaders from the legacy ELF32 format to the new TLV format. This change requires the new TLV versions of the r570.144 firmware images. Because we are no longer loading ELF images, we can also delete the ELF parser. Also remove function request_firmware() as this was the last user. Signed-off-by: Timur Tabi <ttabi@nvidia.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Tested-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://patch.msgid.link/20260731201017.2580713-8-ttabi@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-08-06gpu: nova-core: transition gen_bootloader to TLV imagesTimur Tabi
Switch the generic bootloader firmware loader from the legacy binary format to the TLV format. This change requires the new TLV versions of the r570.144 firmware images. Signed-off-by: Timur Tabi <ttabi@nvidia.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Tested-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://patch.msgid.link/20260731201017.2580713-7-ttabi@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-08-06gpu: nova-core: transition gsp to TLV imagesTimur Tabi
Switch the GSP firmware loader from the legacy binary format to the TLV format. This change requires the new TLV versions of the r570.144 firmware images. Unlike the other TLV firmware images, gsp.tlv contains a pointer to the actual GSP firmware file instead of its contents. This allows each small gsp.tlv file to contain the distinct metadata for each GPU while still allowing the very large gsp.bin to be shared by all GPUs. One key piece of metadata is the signature. The legacy GSP firmware image is an ELF file that contains multiple sections that needed to be parsed, and the driver needed to determine which section is relevant for the GPU. Instead, gsp.tlv contains the pre-processed metadata, so all the driver needs to do is to extract it. Signed-off-by: Timur Tabi <ttabi@nvidia.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Tested-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://patch.msgid.link/20260731201017.2580713-6-ttabi@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-08-06gpu: nova-core: transition booter to TLV imagesTimur Tabi
Switch the booter firmware loader from the legacy binary format to the TLV format. This change requires the new TLV versions of the r570.144 firmware images. The new TLV format has all of the metadata needed by Nova encoded as separate tags, eliminating the need to parse legacy firmware headers such as HsHeaderV2 and HsSignatureParams. All of the structs and code for parsing those headers is therefore deleted. Signed-off-by: Timur Tabi <ttabi@nvidia.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Tested-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://patch.msgid.link/20260731201017.2580713-5-ttabi@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-08-06gpu: nova-core: add TLV parser for firmware filesTimur Tabi
TLV (type, length, value) files are the new image format used by Nova to encapsulate firmware images and their metadata. Unlike the firmware files for previous versions of the firmware, TLV filenames are not versioned, and they have a .tlv suffix. Add function request_tlv() to load TLV firmware images. Add the Tlv struct and supporting types for parsing TLV firmware images. TLV files begin with a 4-byte magic header, which must be "NVFW" for Nvidia firmware files. This is followed by a sequence of blocks each containing a 4-byte ASCII tag, a 4-byte little-endian length, and a payload padded to a 4-byte boundary. Tlv::new() validates the entire image up front, so that the iterator can subsequently yield blocks without fallible parsing. Also add accessor methods for the various encoded types that will be used by the driver. Signed-off-by: Timur Tabi <ttabi@nvidia.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Tested-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://patch.msgid.link/20260731201017.2580713-4-ttabi@nvidia.com [ Drop unnecessary payload.is_empty() check in Tlv::new(), use EINVAL instead of ENODATA in Tlv::get_bytes() and add a corresponding TODO comment. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-08-05Merge tag 'nf-next-26-07-31' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next: 1) Update conncount to use the original tuple after ct lookup to ensure consistent counting, from Fernando F. Mancera. 2) Remove redundant net_device field in info structure that helps parse the flowtable path discovery. 3) Move net_device to flowtable check to the flowtable discovery path parser. This is preparation work to pass the tunnel dst_entry via .fill_forward_path. 4) Update DSA .fill_forward_path to break at the user DSA, since the conduit DSA is not used in the datapath. This slighly simplifies the flowtable path discovery parser. 5) Do not advance index in the path stack prematurely, otherwise it points to uninitialized slots on error. Not an issue currently but it could be once tunnel dst_entry is passed via .fill_forward_path. 6) Pass the tunnel dst_entry via dev_fill_forward_path(). 7) Update ipip and ip6ip6 tunnels to pass the dst_entry through dev_fill_forward_path(). 8) Call skb_valid_dst() before accessing skb_dst() to ensure dst_entry is not a template. 9) Use UNACK timeout when RST packet does not match the expected window while in ESTABLISHED state, the existing approach the CLOSE state timeout which is only 10 seconds. Adopt a more conservative timeout by default for this case. * tag 'nf-next-26-07-31' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets netfilter: nf_tables: call skb_valid_dst() before skb_dst() netfilter: flowtable: release tunnel route on error when building forward path net: pass dst via net_device_path in dev_fill_forward_path() net: do not advance stack index from dev_fwd_path() net: dsa: stop at the user device in .fill_forward_path netfilter: flowtable: consolidate flowtable device check netfilter: flowtable: consolidate net_device field in nft_forward_info struct netfilter: conncount: normalize tuple and zone on successful ct lookup ==================== Link: https://patch.msgid.link/20260731153402.851224-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05Merge branch 'for-7.3/cxl-port-err-prep' into cxl-for-nextDave Jiang
cxl: Rename find_cxl_port() to find_cxl_port_by_dport() cxl: Tighten CPER kfifo registration API and symbol visibility acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
2026-08-05drm/panel-edp: Add pre_unprepare delayHsin-Te Yuan
In eDP power-off timing specifications, T10 defines the minimum delay required between the end of valid video data from the source and panel power-down (main VDD off). Currently, panel-edp only supports the 'disable' delay, which corresponds to T9 (backlight off to end of video data) and runs in panel_edp_disable() while video data is still active. For panels that require a delay after video data has stopped before cutting power, this delay must occur in panel_edp_unprepare() before turning off power rails. Add a 'pre_unprepare' field to struct panel_delay to model T10-min, and delay for this duration in panel_edp_unprepare() before calling pm_runtime_put_sync_suspend(). Additionally, adjust the timing entry for TM156VDXP25 to use delay_200_500_e80_pu100 (enable = 80ms, pre_unprepare = 100ms) to match its panel specification, replacing the previous delay_200_500_e50_d100. Fixes: b9e2d5cdaab0 ("drm/panel-edp: Support NV140FHM-N5B and TM156VDXP25") Signed-off-by: Hsin-Te Yuan <yuanhsinte@chromium.org> Reviewed-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260803-edp-v1-1-3e92dec1d56c@chromium.org
2026-08-05cxl: Rename find_cxl_port() to find_cxl_port_by_dport()Dan Williams
find_cxl_port() and find_cxl_port_by_uport() are internal port lookup functions that search the CXL bus by dport and uport respectively, but their names do not make the lookup method clear. Rename find_cxl_port() to find_cxl_port_by_dport() to make the lookup method explicit and consistent with find_cxl_port_by_uport(). Both functions remain static to port.c; the upcoming patch that adds the first cross-file caller will widen their scope. Make the same naming change to static helper __find_cxl_port_by_dport(). Co-developed-by: Terry Bowman <terry.bowman@amd.com> Signed-off-by: Terry Bowman <terry.bowman@amd.com> Signed-off-by: Dan Williams <djbw@kernel.org> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Alison Schofield <alison.schofield@intel.com> Reviewed-by: Jonathan Cameron <jic23@kernel.org> Link: https://patch.msgid.link/20260803221810.3685703-6-terry.bowman@amd.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-08-05cxl: Tighten CPER kfifo registration API and symbol visibilityDan Williams
Tighten the CPER protocol error kfifo registration API and symbol visibility. Use EXPORT_SYMBOL_FOR_MODULES() instead of EXPORT_SYMBOL_NS_GPL() for the CPER kfifo registration symbols. This names the consuming module explicitly and gives compile-time enforcement. Drop the work_struct argument from the unregister path. Change the WARN_ONCE condition to a NULL check since there is no caller pointer to compare against anymore. Return void from the registration helpers whose result callers ignore. cxl_cper_register_work() keeps its int return as the only one consumed by a caller. Flag double registration with WARN_ONCE() inside the lock instead of returning an error. Change cxl_ras_init() to void because there is one consumer and one producer so the error return was unnecessary. Remove the now-dead error check in cxl_core_init(). Co-developed-by: Terry Bowman <terry.bowman@amd.com> Signed-off-by: Terry Bowman <terry.bowman@amd.com> Signed-off-by: Dan Williams <djbw@kernel.org> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Alison Schofield <alison.schofield@intel.com> Link: https://patch.msgid.link/20260803221810.3685703-5-terry.bowman@amd.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-08-05acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locksTerry Bowman
The CXL CPER work registration and unregistration helpers acquire cxl_cper_work_lock and cxl_cper_prot_err_work_lock with a spinlock guard(), which leaves local interrupts enabled. The corresponding post paths (cxl_cper_post_event(), cxl_cper_post_prot_err()) execute in hard IRQ context (they are called from the GHES error notification path) and acquire the same locks with an irqsave guard(). If a CPU is holding one of these locks via a spinlock guard() when a GHES interrupt arrives on the same CPU, the IRQ handler spins on the held lock waiting for it to release, while the lock holder is preempted by the IRQ. The result is a deadlock. Convert both locks from spinlock_t to raw_spinlock_t and use guard() at all call sites. On PREEMPT_RT kernels spinlock_t is backed by rt_mutex and sleeping from hard IRQ context is not permitted; raw_spinlock_t is safe in both contexts. Add WARN_ONCE to both register functions to surface double-registration bugs at runtime. Restructure both unregister functions to clear the global work pointer under the lock before calling cancel_work_sync(), closing the window where a CPER interrupt could schedule work on a pointer about to be freed. Add kfifo_reset() after cancel_work_sync() so stale entries are not replayed on next module load. Both kfifos are single-consumer: only one work_struct is registered at a time, enforced by the WARN_ONCE guard in the register functions. kfifo_reset() is safe outside the lock because cancel_work_sync() has already quiesced the consumer, and no new consumer can register until the current module exit completes and a fresh module init runs. Remove the redundant cancel_work_sync() call from cxl_ras_exit() and cxl_pci_driver_exit(). The CPER unregister functions now quiesce the work internally. Reported-by: Sashiko <sashiko@linuxfoundation.org> Signed-off-by: Terry Bowman <terry.bowman@amd.com> Fixes: 5e4a264bf8b5 ("acpi/ghes: Process CXL Component Events") Fixes: 36f257e3b0ba ("acpi/ghes, cxl/pci: Process CXL CPER Protocol Errors") Cc: stable@vger.kernel.org Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Tony Luck <tony.luck@intel.com> Link: https://patch.msgid.link/20260803221810.3685703-4-terry.bowman@amd.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-08-05cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity registerTerry Bowman
cxl_rch_get_aer_severity() classifies RCH Downstream Port uncorrectable errors as fatal or non-fatal by ANDing uncorrectable status with PCI_ERR_ROOT_FATAL_RCV. This is wrong because PCI_ERR_ROOT_FATAL_RCV is a Root Error Status register bit (bit 6), not a severity bit. ANDing it against uncorrectable status tests a reserved bit and produces incorrect severity classification. Fix by ANDing the unmasked uncor_status against uncor_severity. Per PCIe Base Spec r6.0 Section 7.8.4.4, each bit in the Uncorrectable Error Severity register indicates whether the corresponding error is fatal (1) or non-fatal (0). Fixes: 6ac07883dbb5 ("cxl/pci: Add RCH downstream port error logging") Cc: stable@vger.kernel.org Signed-off-by: Terry Bowman <terry.bowman@amd.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Richard Cheng <icheng@nvidia.com> Reviewed-by: Alison Schofield <alison.schofield@intel.com> Link: https://patch.msgid.link/20260803221810.3685703-3-terry.bowman@amd.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-08-05cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register readTerry Bowman
cxl_rch_get_aer_info() copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl() loop bounded by sizeof(struct aer_capability_regs). This struct is a software layout and its embedded struct pcie_tlp_log is larger than the on-wire AER capability. As a result the loop reads past the mapped AER register block. The over-read also populates the software-only tail fields including header_log.header_len. An out-of-range header_len passed to pcie_print_tlp_log() can then loop past the header log buffer and cause a second out-of-bounds read. The read was correct when introduced, but struct pcie_tlp_log has since grown (Header Log and TLP Prefix Log sizes, header_len and flit fields), so sizeof(struct aer_capability_regs) no longer matches the physical AER capability. Bound the read to the physical AER registers, header through the 16 byte Header Log. Zero the destination first so the software-only fields are deterministic. Fixes: 6ac07883dbb5 ("cxl/pci: Add RCH downstream port error logging") Reported-by: Sashiko <sashiko@linuxfoundation.org> Cc: stable@vger.kernel.org Signed-off-by: Terry Bowman <terry.bowman@amd.com> Reviewed-by: Alison Schofield <alison.schofield@intel.com> Link: https://patch.msgid.link/20260803221810.3685703-2-terry.bowman@amd.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-08-05clk: rockchip: rk3576: fix source muxes for SPI0..SPI4Alexey Charkov
The TRM defines available source muxes for SPI0..SPI4 as - b00: clk_gpll_div6_src - b01: clk_gpll_div8_src - b10: clk_cpll_div10_src - b11: clk_xin_osc0_func Which doesn't match what the current clock driver implements, making it impossible to derive some SPI clock rates such as 37.125 MHz (which requires clk_gpll_div8_src as the source mux). Add a correct mux definition per TRM and point SPI0..SPI4 clocks at it. Fixes: cc40f5baa91b ("clk: rockchip: Add clock controller for the RK3576") Signed-off-by: Alexey Charkov <alchark@flipper.net> Link: https://patch.msgid.link/20260805-rk3576-spi-clk-v1-1-2f040d0d163b@flipper.net Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-08-05clk: rockchip: Add clock controller for the RV1106Simon Glass
Add the clock and reset controller driver for the Rockchip RV1106, based on the vendor kernel from the Luckfox Pico SDK [1] at commit 824b817f8 (a Linux 5.10.160 kernel tree), adapted to the upstream clock framework. The MMC drive and sample phase clocks have their control registers in the GRF region. The CRU provides these clocks itself, using the syscon referenced by the rockchip,grf property as an auxiliary regmap, in the same way as the RK3528. The RV1103 is a package variant of the RV1106 and uses the same CRU. [1] https://github.com/LuckfoxTECH/luckfox-pico Signed-off-by: Simon Glass <sjg@chromium.org> Link: https://patch.msgid.link/20260729133609.3465563-3-sjg@chromium.org Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-08-05Merge branch 'for-7.3/cxl-misc' into cxl-for-nextDave Jiang
cxl/test: Assign one mock memdev a full-width serial number cxl/core: Format the memdev serial number as unsigned in TP_printk cxl/pmem: Format the nvdimm serial number as unsigned decimal
2026-08-05cxl/core: Format the memdev serial number as unsigned in TP_printkAlison Schofield
The CXL memdev serial number is a u64 PCIe Device Serial Number, but the tracepoints format it with %lld. Devices whose vendor OUI sets bit 63 therefore appear with negative serial numbers in formatted trace output. Note that the trace data itself is already stored correctly as u64. Format the TP_printk serial as unsigned decimal, %llu, to match the underlying value. Signed-off-by: Alison Schofield <alison.schofield@intel.com> Link: https://patch.msgid.link/46651395b6c1e552ae2c4fecf3058a062eb0c3f0.1784924949.git.alison.schofield@intel.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-08-05cxl/pmem: Format the nvdimm serial number as unsigned decimalAlison Schofield
The CXL NVDIMM security passphrase key description and the nvdimm 'id' sysfs attribute are both derived from the CXL device serial number, but the serial number is not formatted consistently. The key description is formatted in hexadecimal while the 'id' attribute is formatted in decimal. As a result, ndctl stores the key using a decimal description while the kernel later looks it up using a hexadecimal description. For serial numbers of 10 and above, the descriptions no longer match, preventing automatic unlock after reboot. The decimal formatting has a second problem: both the key description and the 'id' attribute use the signed %lld format for a u64 PCIe Device Serial Number. Devices whose vendor OUI sets bit 63, such as Montage CXL devices, appear with negative decimal serial numbers. Format the security key description and 'id' attribute as unsigned decimal, %llu, and document that the 'id' attribute is an unsigned decimal value. The key lookup mismatch was exposed by CXL unit test cxl-security.sh when cxl_test mock serial numbers were extended to 10 and above. A work around is described for ndctl load-key users here: https://github.com/pmem/ndctl/issues/299 Cc: stable@vger.kernel.org Fixes: b5807c80b5bc ("cxl: add dimm_id support for __nvdimm_create()") Acked-by: Dan Williams <djbw@kernel.org> Signed-off-by: Alison Schofield <alison.schofield@intel.com> Link: https://patch.msgid.link/2c673a5ba0a8fa93ad160578e193bd556091fa95.1784924949.git.alison.schofield@intel.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-08-05drm/nouveau: Wire up dmem cgroupsNatalie Vock
Userspace can now make use of memory protection via dmem cgroups. Let nouveau benefit from this as well by registering the vram region with the dmem cgroup controller. This patch adapts the approach amdgpu and Xe have taken for enabling dmem cgroups. Signed-off-by: Natalie Vock <natalie.vock@gmx.de> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patch.msgid.link/20260410081322.5577-1-natalie.vock@gmx.de
2026-08-05rapidio: mport_cdev: fix use-after-free in dma_req_free()James Kim
dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface. Link: https://lore.kernel.org/20260723235220.588424-1-james010kim@gmail.com Fixes: e8de370188d0 ("rapidio: add mport char device driver") Signed-off-by: James Kim <james010kim@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Cc: Alexandre Bounine <alex.bou9@gmail.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Matt Porter <mporter@kernel.crashing.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-05RDMA/cxgb4: remove dead NULL checks after GFP_NOFAIL allocationsGou Hao
alloc_skb() with the __GFP_NOFAIL flag will never return NULL, so the subsequent NULL checks and error handling are unreachable dead code. Remove them. Link: https://lore.kernel.org/20260724022851.466017-7-gouhao@uniontech.com Signed-off-by: Gou Hao <gouhao@uniontech.com> Cc: Bharat Potnuri <bharat@chelsio.com> Cc: Cédric Le Goater <clg@kaod.org> Cc: Dave Airlie <airlied@gmail.com> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: jiazhenyuan <jiazhenyuan@uniontech.com> Cc: Leon Romanovsky <leon@kernel.org> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Nam Cao <namcao@linutronix.de> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Nilay Shroff <nilay@linux.ibm.com> Cc: Shrikanth Hegde <sshegde@linux.ibm.com> Cc: Thomas Zimemrmann <tzimmermann@suse.de> Cc: Wentao Guan <guanwentao@uniontech.com> Cc: Alistair Popple <apopple@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-05drm: remove dead WARN_ON NULL check after GFP_NOFAIL allocationGou Hao
kzalloc_obj with the __GFP_NOFAIL flag will never return NULL, so the subsequent WARN_ON(!ctx) is unreachable dead code. Remove it. Link: https://lore.kernel.org/20260724022851.466017-5-gouhao@uniontech.com Signed-off-by: Gou Hao <gouhao@uniontech.com> Cc: Bharat Potnuri <bharat@chelsio.com> Cc: Cédric Le Goater <clg@kaod.org> Cc: Dave Airlie <airlied@gmail.com> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: jiazhenyuan <jiazhenyuan@uniontech.com> Cc: Leon Romanovsky <leon@kernel.org> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Nam Cao <namcao@linutronix.de> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Nilay Shroff <nilay@linux.ibm.com> Cc: Shrikanth Hegde <sshegde@linux.ibm.com> Cc: Thomas Zimemrmann <tzimmermann@suse.de> Cc: Wentao Guan <guanwentao@uniontech.com> Cc: Alistair Popple <apopple@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-05ACPI: video: force native backlight on Acer Nitro AN515-46Marcos Paulo Medeiros
The Acer Nitro AN515-46 is a hybrid graphics laptop whose internal panel is driven by the AMD GPU (Radeon 680M); the discrete NVIDIA GPU only drives external outputs. The firmware nevertheless advertises the NVIDIA WMI EC backlight GUID, so the backlight type resolves to nvidia_wmi_ec. The nvidia-wmi-ec-backlight driver however fails to probe ("EC backlight control failed: AE_NOT_FOUND") and, since the backlight type is still nvidia_wmi_ec, amdgpu skips registering its own backlight device. The result is no backlight device at all, leaving the brightness keys and the desktop brightness slider non-functional. Booting with acpi_backlight=native makes amdgpu register its backlight interface and brightness control works. Add a DMI quirk to use the native backlight on this model by default. Signed-off-by: Marcos Paulo Medeiros <maarcospm1996@gmail.com> Link: https://patch.msgid.link/20260727132151.12792-1-maarcospm1996@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-08-05Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queueDmitry Torokhov
Previously, rmi_f54_buffer_queue() waited for the worker thread to finish but ignored whether it succeeded. If the worker failed (e.g., due to a timeout or register read failure), the queue thread would silently return success, delivering stale or uninitialized memory to userspace. Add a 'report_error' field to struct f54_data to store the worker's exit status. Check this field in rmi_f54_buffer_queue() after the worker finishes, and mark the buffer as VB2_BUF_STATE_ERROR if an error occurred. Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics") Reported-by: sashiko-bot@kernel.org Cc: stable@vger.kernel.org Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/20260626051802.4033172-6-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-05vfio/pci: Avoid mapping BARs for devices with non-mappable BARsFarhan Ali
vfio_pci_core_map_bars() calls pci_iomap() to set up BAR resources, but not all devices support having their BARs mapped by the CPU. The non_mappable_bars flag indicates that a PCI device's BARs cannot be accessed by the CPU. The ISM device on s390 is one such device. The BAR size for an ISM device is 256 TiB, and attempting to map the BAR will lead to warnings: vmalloc_node_range for size 281474976714752 failed: Address range restricted to 0x2110bab00000 - 0x21903ab00000 Use pdev->non_mappable_bars to skip pci_iomap() for such devices. This flag is set by the PCI core at enumeration time and already serves the same purpose in vfio_pci_probe_mmaps(). Fixes: 05f2a68b407a ("vfio/pci: Set up BAR resources and maps in vfio_pci_core_enable()") Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Farhan Ali <alifm@linux.ibm.com> Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Link: https://lore.kernel.org/r/20260729181116.1373-1-alifm@linux.ibm.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-08-05Merge tag 'renesas-r8a78000-dt-binding-defs-tag2' into renesas-clk-for-v7.3Geert Uytterhoeven
Renesas R-Car X5H CPG DT Binding Definitions DT bindings and binding definitions for the Renesas R-Car X5H (R8A78000) Clock Pulse Generator (CPG), shared by driver and DT source files.
2026-08-05Merge tag 'soc-fixes-7.2-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "The majority of the fixes this time is for Qualcomm devicetree files, addressing various incorrect settings in chip specific dtsi files that prevent some feature from working correctly. Another three such issues are addressed on the Broadcom bcm5301x and bcm2712 SoC platforms. Two minor issues are addressed in nuvoton and aspeed specific SoC drivers, and the MAINTAINERS file is updated to add Billy Tsai and Ryan Chen as aspeed reviewers as well as clarify the NXP/Freescale entries" * tag 'soc-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: MAINTAINERS: add Ryan Chen and Billy Tsai as reviewer for ARM/ASPEED ARM: dts: BCM5301X: EA9200: fix NVRAM size ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt arm64: dts: qcom: eliza: Fix DSI1 phy reference clock rate MAINTAINERS: ARM/FREESCALE: merge Layerscape entry into i.MX entry ARM: npcm: Fix OF node refcount leaks in SMP setup soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle arm64: dts: qcom: sc8280xp: gaokun3: correct EC interrupt pin arm64: dts: qcom: sc8280xp: add several missing pdc map entries arm64: dts: qcom: sm8650: Fix IPA IMEM slice arm64: dts: qcom: monaco: Add default GIC address cells arm64: dts: qcom: purwa: Fix GPU IOMMU property arm64: dts: qcom: glymur: fix QUP serial engine IRQs arm64: dts: qcom: glymur: fix PCIe SMMU interrupts
2026-08-05RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQYehyeong Lee
srp_recv_done() passes wc->byte_len to srp_process_rsp(). It passes nothing to srp_process_cred_req() and srp_process_aer_req(), which read fixed-size fields from the receive buffer without checking that those fields were received. The buffer size is max_ti_iu_len, which comes from the login response and is not validated. A target that advertises 8 and then sends an 8-byte SRP_CRED_REQ makes the initiator read req->tag from beyond the end of the buffer. req->tag is copied into the SRP_CRED_RSP and sent back, so those bytes reach the target. SRP_AER_REQ behaves the same way and also reads req->lun. The leak is 8 bytes per response. max_ti_iu_len also decides which slab cache the buffer comes from. With 8 the buffer is a kmalloc-8 object and the read is entirely outside it: BUG: KASAN: slab-out-of-bounds in srp_recv_done+0x172b/0x1aa0 Read of size 8 at addr ffff888104714da8 by task kworker/u8:3/50 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes to the right of allocated 8-byte region [ffff888104714da0, ffff888104714da8) Without KASAN the returned bytes are whatever is next in the slab. One run returned ".strtab". rsp->data[3] in srp_process_rsp() has the same problem: only resp_data_len is checked before it is read. Drop a request that is shorter than the structure being parsed, and check byte_len before the tsk_mgmt read. Fixes: bb12588a38e6 ("IB/srp: Implement SRP_CRED_REQ and SRP_AER_REQ") Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr> Link: https://patch.msgid.link/20260729093203.1503201-1-yhlee@isslab.korea.ac.kr Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-08-05RDMA/erdma: Hold QP references for AE and CM processingCheng Xu
AE QP fatal events and iWARP CM paths load QPs from dev->qp_xa and then use or reference them outside the xarray lock. erdma_destroy_qp() can drop the destroy-path reference and free QP resources while such a lookup is in flight. Add erdma_qp_get_by_qpn() to acquire a kref under the xarray lock with kref_get_unless_zero(). Remove the QP from the xarray before dropping the destroy-path reference so no new lookup can acquire it while destruction waits for existing users. Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation") Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com> Link: https://patch.msgid.link/20260730124357.12976-2-chengyou@linux.alibaba.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-08-05RDMA/erdma: Hold CQ references when processing EQ eventsCheng Xu
EQ handlers look up CQs from dev->cq_xa and invoke CQ completion or error callbacks outside the xarray lock. erdma_destroy_cq() can erase the CQ from the xarray and free its queue buffer and doorbell record while a previously scheduled EQ handler is still using the CQ. Add a CQ refcount and take a reference under the xarray lock with refcount_inc_not_zero(). Remove the CQ from the xarray before dropping the destroy-path reference, then wait for in-flight EQ users before releasing CQ resources. Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation") Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com> Link: https://patch.msgid.link/20260730124357.12976-1-chengyou@linux.alibaba.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-08-05RDMA/mana_ib: UC QP support for UAPIKonstantin Taranov
Implement UC QP creation in the RNIC HW for user API. An UC QP is exposed as three work queues: send, receive, and memory management. The latter is used for bind and invalidate WQEs to support memory windows. Signed-off-by: Konstantin Taranov <kotaranov@microsoft.com> Link: https://patch.msgid.link/20260723115955.1859519-3-kotaranov@linux.microsoft.com Reviewed-by: Long Li <longli@microsoft.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>