au1000_close() calls free_irq() while aup->lock is still held with
spin_lock_irqsave(). free_irq() can sleep because it takes the IRQ
descriptor request mutex, so it does not belong inside the close-time
spinlocked section.
This was found by our static analysis tool and then confirmed by manual
review of the in-tree au1000_close() .ndo_stop path. The reviewed path
keeps aup->lock held across the MAC reset, queue stop and
free_irq(dev->irq, dev).
A directed runtime validation kept that ndo_stop carrier and the same
free_irq(dev->irq, dev) operation under the driver lock. Lockdep reported
"BUG: sleeping function called from invalid context" and "Invalid wait
context" while free_irq() was taking desc->request_mutex, with
au1000_close() and free_irq() on the stack.
Drop aup->lock before freeing the IRQ. The protected close-time work still
stops the device and queue before IRQ teardown, but the sleepable IRQ core
path now runs outside the spinlocked section.
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260619151816.1144289-1-runyu.xiao@seu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
When sctp_verify_init() encounters unrecognized parameters, it allocates an
err_chunk to report them. However, this chunk is leaked in several code
paths:
1. In sctp_sf_do_5_1B_init(), if security_sctp_assoc_request() fails after
sctp_verify_init() has populated err_chunk, the function returns
immediately without freeing it.
2. In sctp_sf_do_unexpected_init(), the same leak occurs on the
security_sctp_assoc_request() failure path.
3. In sctp_sf_do_unexpected_init(), on the success path after copying
unrecognized parameters to the INIT-ACK, the function returns without
freeing err_chunk, unlike sctp_sf_do_5_1B_init() which properly frees
it.
Fix all three leaks by adding sctp_chunk_free(err_chunk) calls before
returning in the error paths and on the success path in
sctp_sf_do_unexpected_init().
Fixes: c081d53f97 ("security: pass asoc to sctp_assoc_request and sctp_sk_clone")
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/0656704f1b0158287c98aec09ba36c83e4a537ab.1781970534.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the
defragmentation engine (e.g. act_ct on out-of-order fragments). When
that happens the skb is no longer owned by the caller and must not be
touched again.
tcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the
switch and returned the skb to the caller as if classification had
passed. The only qdisc that wires up qevents today is RED, via three call sites
(qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop)
red_enqueue() was continuing to operate on an skb it no longer owns in this
case -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.
tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10
tc filter add block 10 ... action ct
(with ct defrag enabled and traffic that produces out-of-order
fragments, e.g. a fragmented UDP stream)
Handle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress
and egress fast paths do: treat it as stolen and return NULL without
touching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be
dropped/freed here, as it is no longer owned by us.
Fixes: 3f14b377d0 ("net/sched: act_ct: fix skb leak and crash on ooo frags")
Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260620130749.226642-1-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Test that an LWT encapsulation does not silently corrupt XDP metadata
sitting in the skb headroom. Exercise all three LWT dispatch paths:
- BPF LWT xmit prog reserves headroom on the LWT .xmit redirect,
- mpls pushes an MPLS label on the LWT .xmit redirect,
- seg6 in encap mode runs on the LWT .input redirect,
- ioam6 encap inserts an IOAM Hop-by-Hop option on LWT .output redirect.
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Link: https://patch.msgid.link/20260619-bpf-lwt-drop-skb-metadata-v3-2-71d6a33ab76b@cloudflare.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
skb metadata is meant for passing information between XDP and TC. It lives
in the skb headroom, immediately before skb->data. LWT programs cannot
access the __sk_buff->data_meta pseudo-pointer to metadata.
However, LWT encapsulation prepends outer headers, moving skb->data back
over the headroom where the metadata sits. On an RX-originated (forwarded)
packet that still carries XDP metadata this goes wrong in two different
ways, depending on the encap type:
1. Non-BPF LWT encaps (mpls, seg6, ioam6 ...) call skb_push()/skb_pull()
and silently overwrite the metadata that sits in the headroom.
2) BPF LWT xmit calls bpf_skb_change_head(), which uses skb_data_move().
That helper expects metadata immediately before skb->data. But since
the IP output path runs LWT xmit before neighbour output has built
the outgoing L2 header, for forwarded packets skb->data points at the
L3 header while skb_mac_header() still points at the old L2 header.
skb_data_move() sees metadata ending at skb_mac_header(), not before
skb->data, warns and clears metadata:
WARNING: CPU: 21 PID: 454557 at include/linux/skbuff.h:4609 skb_data_move+0x47/0x90
CPU: 21 UID: 0 PID: 454557 Comm: napi/iconduit-g Tainted: G O 6.18.21 #1
RIP: 0010:skb_data_move+0x47/0x90
Call Trace:
<IRQ>
bpf_skb_change_head+0xe6/0x1a0
bpf_prog_...+0x213/0x2e3
run_lwt_bpf.isra.0+0x1d3/0x360
bpf_xmit+0x46/0xe0
lwtunnel_xmit+0xa1/0xf0
ip_finish_output2+0x1e7/0x5e0
ip_output+0x63/0x100
__netif_receive_skb_one_core+0x85/0xa0
process_backlog+0x9c/0x150
__napi_poll+0x2b/0x190
net_rx_action+0x40b/0x7f0
handle_softirqs+0xd2/0x270
do_softirq+0x3f/0x60
</IRQ>
That is what happens, as for how to fix it - a received packet that
carries metadata can reach an encap through any of the three LWT
redirect modes:
LWTUNNEL_STATE_INPUT_REDIRECT
ip6_rcv_finish
dst_input
lwtunnel_input
LWTUNNEL_STATE_OUTPUT_REDIRECT
ip6_rcv_finish
dst_input
ip6_forward
ip6_forward_finish
dst_output
lwtunnel_output
LWTUNNEL_STATE_XMIT_REDIRECT
ip6_rcv_finish
dst_input
ip6_forward
ip6_forward_finish
dst_output
ip6_output
ip6_finish_output
ip6_finish_output2
lwtunnel_xmit
Every encap funnels through the three LWT dispatch helpers, so drop the
metadata there, right before handing the skb to the encap op. This
single chokepoint covers all encap types and all three redirect modes:
- lwtunnel_input(): seg6, rpl, ila, seg6_local
- lwtunnel_output(): ioam6
- lwtunnel_xmit(): mpls, LWT BPF xmit
Alternatively, we could clear the metadata right after TC ingress hook.
That would require a compromise, however. Metadata would become
inaccessible from TC egress (in setups where it actually reaches the
hook it tact, that is without any L2 tunnels on path).
Fixes: 8989d328df ("net: Helper to move packet data and metadata after skb_push/pull")
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Link: https://patch.msgid.link/20260619-bpf-lwt-drop-skb-metadata-v3-1-71d6a33ab76b@cloudflare.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Pull NFS client updates from Anna Schumaker:
"New features:
- XPRTRDMA: Decouple req recycling from RPC completion
- NFS: Expose FMODE_NOWAIT for read-only files
Bugfixes:
- SUNRPC:
- Fix sunrpc sysfs error handling
- Fix uninitialized xprt_create_args structure
- XPRTRDMA:
- Harden connect and reply handling
- NFS:
- Fix EOF updates after fallocate/zero-range
- Keep PG_UPTODATE clear after read errors in page groups
- Use nfsi->rwsem to protect traversal of the file lock list
- Prevent resource leak in nfs_alloc_server()
- NFSv4:
- Clear exception state on successful mkdir retry
- Don't skip revalidate when holding a dir delegation and attrs are stale
- pNFS:
- Fix use-after-free in pnfs_update_layout()
- Defer return_range callbacks until after inode unlock
- Fix LAYOUTCOMMIT retry loop on OLD_STATEID
- Reject zero-length r_addr in nfs4_decode_mp_ds_addr
- NFS/flexfiles:
- Reject zero-length filehandle version arrays
- Fix checking if a layout is striped
- Fixes for honoring FF_FLAGS_NO_IO_THRU_MDS
Other cleanups and improvements:
- Remove the fileid field from struct nfs_inode
- Move long-delayed xprtrdma work onto the system_dfl_long_wq
- Convert xprtrdma send buffer free list to an llist
- Show "<redacted>" for cert_serial and privkey_serial mount options"
* tag 'nfs-for-7.2-1' of git://git.linux-nfs.org/projects/anna/linux-nfs: (42 commits)
NFS: Use common error handling code in nfs_alloc_server()
NFS: Prevent resource leak in nfs_alloc_server()
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
nfs: don't skip revalidate on directory delegation when attrs flagged stale
xprtrdma: Return sendctx slot after Send preparation failure
xprtrdma: Repost Receive buffers for malformed replies
xprtrdma: Sanitize the reply credit grant after parsing
xprtrdma: Fix bcall rep leak and unbounded peek
xprtrdma: Resize reply buffers before reposting receives
xprtrdma: Check frwr_wp_create() during connect
xprtrdma: Initialize re_id before removal registration
xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
xprtrdma: Convert send buffer free list to llist
NFS: correct CONFIG_NFS_V4 macro name in #endif comment
nfs: use nfsi->rwsem to protect traversal of the file lock list
NFSv4.1/pNFS: fix LAYOUTCOMMIT retry loop on OLD_STATEID
nfs: expose FMODE_NOWAIT for read-only files
nfs: add nowait version of nfs_start_io_direct
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
...
Pull f2fs updates from Jaegeuk Kim:
"The changes primarily focus on filesystem error reporting, reducing
memory footprint by reverting in-memory data structures used for
runtime validation, honoring FDP hints, and adding trace and debug
logs. In addition, there are critical bug fixes resolving
out-of-bounds read vulnerabilities in inline directory and ACL
handling, potential deadlocks in balance_fs, use-after-free issues in
atomic writes, and false data/node type assignments in large sections.
Enhancements:
- Revert in-memory sit version and block bitmaps
- support to report fserror
- add trace_f2fs_fault_report
- add iostat latency tracking for direct IO
- add logs in f2fs_disable_checkpoint()
- honor per-I/O write streams for direct writes
- map data writes to FDP streams
- skip inode folio lookup for cached overwrite
- skip direct I/O iostat context when disabled
- revert "check in-memory block bitmap"
- revert "check in-memory sit version bitmap"
Fixes:
- optimize representative type determination in GC
- fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
- fix potential deadlock in f2fs_balance_fs()
- fix potential deadlock in gc_merge path of f2fs_balance_fs()
- atomic: fix UAF issue on f2fs_inode_info.atomic_inode
- fix missing read bio submission on large folio error
- pass correct iostat type for single node writes
- fix to do sanity check on f2fs_get_node_folio_ra()
- validate orphan inode entry count
- keep atomic write retry from zeroing original data
- read COW data with the original inode during atomic write
- validate inline dentry name lengths before conversion
- validate dentry name length before lookup compares it
- reject setattr size changes on large folio files
- revert "remove non-uptodate folio from the page cache in move_data_block"
- validate ACL entry sizes in f2fs_acl_from_disk()
- bound i_inline_xattr_size for non-inline-xattr inodes
- fix listxattr handling of corrupted xattr entries
- fix to round down start offset of fallocate for pin file"
* tag 'f2fs-for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (42 commits)
f2fs: fix to round down start offset of fallocate for pin file
f2fs: fix listxattr handling of corrupted xattr entries
f2fs: skip direct I/O iostat context when disabled
f2fs: remove unneeded f2fs_is_compressed_page()
f2fs: avoid unnecessary fscrypt_finalize_bounce_page()
f2fs: avoid unnecessary sanity check on ckpt_valid_blocks
f2fs: misc cleanup in f2fs_record_stop_reason()
f2fs: fix wrong description in printed log
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"
f2fs: Split f2fs_write_end_io()
f2fs: Rename f2fs_post_read_wq into f2fs_wq
f2fs: Prepare for supporting delayed bio completion
f2fs: reject setattr size changes on large folio files
f2fs: validate dentry name length before lookup compares it
f2fs: validate inline dentry name lengths before conversion
f2fs: read COW data with the original inode during atomic write
f2fs: skip inode folio lookup for cached overwrite
f2fs: keep atomic write retry from zeroing original data
...
Pull x86 fix from Ingo Molnar:
- Prevent NULL dereference on theoretical missing IO bitmap (Li
RongQing)
* tag 'x86-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/ioperm: Prevent NULL dereference on theoretical missing IO bitmap
Pull misc timer fixes from Ingo Molnar:
- Fix timekeeping locking order bug in the timekeeping init code
(Mikhail Gavrilov)
- Fix u64 multiplication bug in the posix-cpu-timers code on 32-bit
kernels (Zhan Xusheng)
- Fix macro name in comment block (Ethan Nelson-Moore)
- Fix off-by-one bug in the compat settimeofday() usecs validation code
(Wang Yan)
* tag 'timers-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
time: Fix off-by-one in compat settimeofday() usec validation
hrtimer: Correct CONFIG_NO_HZ_COMMON macro name in comment
posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
timekeeping: Register default clocksource before taking tk_core.lock
Pull misc CPU hotplug fixes from Ingo Molnar:
- Fix CPU hotplug error handling rollback bug (Bradley Morgan)
- Fix possible output OOB write bug in the sysfs hotplug states
printing code (Bradley Morgan)
* tag 'smp-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
cpu: hotplug: Bound hotplug states sysfs output
cpu: hotplug: Preserve per instance callback errors
Steffen Klassert says:
====================
pull request (net): ipsec 2026-06-22
1) xfrm: use compat translator only for u64 alignment mismatch
Gate the XFRM_USER_COMPAT translator on COMPAT_FOR_U64_ALIGNMENT
so 32-bit compat tasks on arches whose 32-bit ABI already matches
the native 64-bit layout are no longer rejected with -EOPNOTSUPP.
From Sanman Pradhan.
2) net: af_key: initialize alg_key_len for IPComp states
Initialize the alg_key_len to 0 in the IPComp branch of
pfkey_msg2xfrm_state() so an uninitialized value cannot drive
xfrm_alg_len() into a slab-out-of-bounds kmemdup during
XFRM_MSG_MIGRATE. From Zijing Yin.
3) xfrm: Fix dev use-after-free in xfrm async resumption
Stash the original skb->dev and extend the RCU critical section
across xfrm_rcv_cb() and transport_finish() to prevent a
tunnel-device UAF and original-device refcount leak when a
callback replaces skb->dev. From Dong Chenchen.
4) xfrm: Fix xfrm state cache insertion race
Move the state-validity check inside xfrm_state_lock in the
input state cache insertion path so a state cannot be killed
between the check and the insert. From Herbert Xu.
5) xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]
Add READ_ONCE()/WRITE_ONCE() annotations on xfrm_policy_count
and xfrm_policy_default to silence the KCSAN data race reported
on net->xfrm.policy_count. From Eric Dumazet.
6) espintcp: use sk_msg_free_partial to fix partial send
Replace the manual skmsg accounting in espintcp with
sk_msg_free_partial() so the skmsg stays consistent on every
iteration and the partial-send accounting bugs go away.
From Sabrina Dubroca.
7) xfrm: validate selector family and prefixlen during match
Reject mismatched address families in xfrm_selector_match() and
bound prefixlen in addr4_match()/addr_match() to prevent the
shift-out-of-bounds syzbot reported when an AF_UNSPEC selector
with a large prefixlen is matched against an IPv4 flow.
From Eric Dumazet.
* tag 'ipsec-2026-06-22' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:
xfrm: validate selector family and prefixlen during match
espintcp: use sk_msg_free_partial to fix partial send
xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]
xfrm: Fix xfrm state cache insertion race
xfrm: Fix dev use-after-free in xfrm async resumption
net: af_key: initialize alg_key_len for IPComp states
xfrm: use compat translator only for u64 alignment mismatch
====================
Link: https://patch.msgid.link/20260622075726.29685-1-steffen.klassert@secunet.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Pull locking fix from Ingo Molnar:
- Fix the incorrect RCU protection in rt_spin_unlock() (Thomas
Gleixner)
* tag 'locking-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
Pull misc core fixes from Ingo Molnar:
- Fix an MM-CID race that can cause an OOB write (Rik van Riel)
- Fix a debugobjects OOM handling race (Thomas Gleixner)
* tag 'core-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
debugobjects: Plug race against a concurrent OOM disable
sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path
kernel test robot report missing kernel-doc descriptions for the 'wait_ack'
and 'inc_epoch' parameters of smb2_lease_break_noti():
Warning: fs/smb/server/oplock.c:937 function parameter 'wait_ack' not
described in 'smb2_lease_break_noti'
Warning: fs/smb/server/oplock.c:937 function parameter 'inc_epoch' not
described in 'smb2_lease_break_noti'
Document both parameters to silence the warnings.
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Detected by Smatch.
fs/smb/server/oplock.c:1446 smb_grant_oplock()
warn: inconsistent indenting
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
ksmbd_auth_ntlmv2() derives the NTLMv2 session key into
sess->sess_key before it verifies the NTLMv2 response.
ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even
when ksmbd_auth_ntlmv2() failed.
With SMB3 multichannel binding, the failed authentication operates on
an existing session and the session setup error path does not expire
binding sessions. A client can send a binding session setup with a
bad NT proof and KEY_XCH and still modify sess->sess_key before
STATUS_LOGON_FAILURE is returned.
Relevant path:
smb2_sess_setup()
-> conn->binding = true
-> ntlm_authenticate()
-> session_user()
-> ksmbd_decode_ntlmssp_auth_blob()
-> ksmbd_auth_ntlmv2()
-> calc_ntlmv2_hash()
-> hmac_md5_usingrawkey(..., sess->sess_key)
-> crypto_memneq() returns mismatch
-> KEY_XCH arc4_crypt(..., sess->sess_key, ...)
-> out_err without expiring the binding session
Derive the base session key into a local buffer and copy it to
sess->sess_key only after the proof matches. Return immediately on
authentication failure so KEY_XCH is only processed after successful
authentication.
Fixes: e2f34481b2 ("cifsd: add server-side procedures for SMB3")
Fixes: f9929ef6a2 ("ksmbd: add support for key exchange")
Cc: stable@vger.kernel.org
Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Pull dmaengine updates from Vinod Koul:
"Core:
- New devm_of_dma_controller_register() API
- Refactor devm_dma_request_chan() API
New Support:
- Loongson Multi-Channel DMA controller support
- Renesas RZ/{T2H,N2H} support
- Dw CV1800B DMA support
- Switchtec DMA engine driver
U pdates:
- Xilinx AXI dma binding conversion
- Renesas CHCTRL register read updates
- AMD MDB Endpoint and non-LL mode Support
- AXI dma handling of SW and HW cyclic transfers termination
- Intel ioatdma and idxd driver updates"
* tag 'dmaengine-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (62 commits)
dt-bindings: dma: snps,dw-axi-dmac: Add fallback compatible for CV1800B
MAINTAINERS: dmaengine/ti: Remove myself and add Vignesh as maintainer
dmaengine: qcom: Unify user-visible "Qualcomm" name
dt-bindings: dma: qcom,gpi: Document GPI DMA engine for Shikra SoC
dmaengine: qcom: hidma: use sysfs_emit() in sysfs show callbacks
dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc
dmaengine: dw-axi-dmac: drop redundant DMAC enable in block start
dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes
dt-bindings: dma: fsl-edma: add dma-channel-mask property description
dmaengine: tegra: Fix burst size calculation
dmaengine: iop32x-adma: Remove a leftover header file
dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor
dmaengine: dma-axi-dmac: Drop struct clk from main struct
dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc
dmaengine: Fix possible use after free
dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
dmaengine: dw-edma-pcie: Reject devices without driver data
dmaengine: sh: rz-dmac: Add DMA ACK signal routing support
irqchip/renesas-rzv2h: Add DMA ACK signal routing support
dmaengine: dw-edma: Remove dw_edma_add_irq_mask()
...
Pull phy updates from Vinod Koul:
"Bunch of new driver, device support in existing drivers/binding and
few updates to existing drivers
New Support:
- Qualcomm Eliza QMP PHY, Eliza Synopsys eUSB2 support, Eliza PCIe
phy support, Nord QMP UFS PHY, IPQ5210 USB3 PHY support
- Econet EN751221 and EN7528 PCIe phy support
- NXPs TJA1145 CAN transceiver phy support
- TI DS125DF111 retimer phy support
- Rockchip RK3528 usb phy support
- TI J722S phy support
- Axiado eMMC PHY driver
- EyeQ5 Ethernet PHY driver
- Generic PHY driver for Lynx 10G SerDes
- Spacemit K3 USB2 PHY support
Updates:
- Tomi helping maintian zynqmp phys
- lynx phy updates to support 25GBASER
- Rockchip GRF for RK3568/RV1108 support
- Qualcomm QSERDES COM v2 support"
* tag 'phy-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (87 commits)
phy: rockchip: inno-usb2: Add missing clkout_ctl_phy kerneldoc
phy: Move MODULE_DEVICE_TABLE next to the table itself
phy: add basic support for NXPs TJA1145 CAN transceiver
dt-bindings: phy: add support for NXPs TJA1145 CAN transceiver
phy: freescale: phy-fsl-imx8qm-lvds-phy: Fix missing pm_runtime_disable() on probe error path
dt-bindings: phy: qcom,qmp-usb: Add ipq5210 USB3 PHY
dt-bindings: phy: qcom,qusb2: Document IPQ5210 compatible
phy: freescale: phy-fsl-imx8qm-lvds-phy: Use synchronous PM runtime put in reset
MAINTAINERS: expand Lynx 28G entry to cover Lynx 10G SerDes
phy: lynx-10g: new driver
dt-bindings: phy: lynx-10g: initial document
phy: lynx-28g: improve phy_validate() procedure
phy: lynx-28g: optimize read-modify-write operation
phy: lynx-28g: add support for big endian register maps
phy: lynx-28g: common probe() and remove()
phy: lynx-28g: make lynx_28g_pll_read_configuration() callable per PLL
phy: lynx-28g: move struct lynx_info definitions downwards
phy: lynx-28g: provide default lynx_lane_supports_mode() implementation
phy: lynx-28g: generalize protocol converter accessors
phy: lynx-28g: common lynx_pll_get()
...
- Fix typos in documentation (josh ziegler)
- Use FIELD_MODIFY() instead of open-coding it (Hans Zhang)
* pci/misc:
PCI: Use FIELD_MODIFY() instead of open-coding it
Documentation: PCI: Fix typos
- Remove unused gpio.h include from amd-mdb, designware-plat, fu740,
visconti drivers (Andy Shevchenko)
* pci/controller/misc:
PCI: visconti: Drop unused include
PCI: fu740: Drop unused include
PCI: designware-plat: Drop unused include
PCI: amd-mdb: Use the right GPIO header
- Add common TLP Type macros (MRd/Wr, IORd/Wr, CfgRd/Wr 0, CfgRd/Wr 1, Msg)
and use them in aspeed, cadence, dwc, mediatek, tegra drivers (Hans
Zhang)
* pci/controller/tlp_macros:
PCI: cadence: Use common TLP type macros
PCI: dwc: Replace ATU type macros with common TLP type macros
PCI: Add common TLP type macros and convert aspeed/mediatek
- Protect root bus removal with rescan lock in altera, brcmstb, cadence,
dwc, iproc, mediatek, plda, rockchip to prevent use-after-free or crashes
when racing with sysfs rescan or hotplug (Hans Zhang)
* pci/controller/rescan_lock:
PCI: rockchip: Protect root bus removal with rescan lock
PCI: plda: Protect root bus removal with rescan lock
PCI: mediatek: Protect root bus removal with rescan lock
PCI: iproc: Protect root bus removal with rescan lock
PCI: dwc: Protect root bus removal with rescan lock
PCI: cadence: Protect root bus removal with rescan lock
PCI: brcmstb: Protect root bus removal with rescan lock
PCI: altera: Protect root bus removal with rescan lock
- Add pci_host_common_link_train_delay() for the mandatory delay after
> 5GT/s Link training completes and use it for cadence HPA, j721e, LGA;
dwc; aardvark, mediatek-gen3, rzg3s (Hans Zhang)
* pci/controller/link_train_delay:
PCI: rzg3s-host: Use common pci_host_common_link_train_delay() helper
PCI: mediatek-gen3: Add 100 ms delay after link up
PCI: aardvark: Add 100 ms delay after link training
PCI: dwc: Use common pci_host_common_link_train_delay() helper
PCI: cadence-hpa: Add post-link delay
PCI: cadence: Add post-link delay for LGA and j721e glue driver
PCI: Add pci_host_common_link_train_delay() helper
# Conflicts:
# drivers/pci/controller/pci-host-common.h
- Use fixed-width interrupt masks to avoid truncation in 64-bit builds
(Rosen Penev)
* pci/controller/mvebu:
PCI: mvebu: Use fixed-width interrupt masks to avoid truncation in 64-bit builds
- Deassert PCIE_PHY_RSTB so REFCLK is stable for at least 100ms
(PCIE_T_PVPERL_MS) before deasserting PERST# (Jian Yang)
- Add .shutdown() to assert PERST# before powering down device (Jian Yang)
- Do full device power down on removal, including asserting PERST#, when
removing driver (Chen-Yu Tsai)
- Fix a 'failed to create pwrctrl devices' error message that was
inadvertently skipped (Chen-Yu Tsai)
* pci/controller/mediatek-gen3:
PCI: mediatek-gen3: Fix incorrectly skipped pwrctrl error message
PCI: mediatek-gen3: Do full device power down on removal
PCI: mediatek-gen3: Add a .shutdown() callback to control PERST# signal
PCI: mediatek-gen3: Fix PERST# control timing during system startup
- Use FIELD_PREP() to fix incorrect operator precedence in PCIE_FTS_NUM_L0
(Li RongQing)
- Fix IRQ domain leak when port fails to enable (Manivannan Sadhasivam)
- Use actual physical address for MSI message address instead of
virt_to_phys() (Manivannan Sadhasivam)
- Add EcoNet EN7528 to DT binding (Caleb James DeLisle)
* pci/controller/mediatek:
dt-bindings: PCI: mediatek: Add support for EcoNet EN7528
PCI: mediatek: Use actual physical address instead of virt_to_phys()
PCI: mediatek: Fix IRQ domain leak when port fails to enable
PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
- Ignore downstream devices only on internal bridges to avoid Loongson
hardware issue (Rong Zhang)
- Quirk old Loongson-3C6000 bridges that advertise incorrect supported link
speeds (Ziyao Li)
* pci/controller/loongson:
PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series
PCI: loongson: Do not ignore downstream devices on external bridges
- Restore .map_irq() assignment that broke INTx on the iproc platform bus
driver (Mark Tomlinson)
* pci/controller/iproc-bcma:
PCI: iproc: Restore .map_irq() for the platform bus driver
- Program the DesignWare PORT_AFR L1 entrance latency based on the
'aspm-l1-entry-delay-ns' DT property (Manikanta Maddireddy)
* pci/controller/dwc-tegra194:
PCI: tegra194: Use aspm-l1-entry-delay-ns DT property for L1 entrance latency
- Set max OPP during resume so DBI register accesses don't fail with NoC
errors (Qiang Yu)
- Add pci_host_common_d3cold_possible() to determine whether downstream
devices are already in D3hot and wakeup-enabled devices are capable of
generating PME from D3cold (Krishna Chaitanya Chundru)
- Add a .get_ltssm() callback to get the LTSSM status without DBI, since
DBI may be inaccessible after PME_Turn_Off (Krishna Chaitanya Chundru)
- Power down PHY via PARF_PHY_CTRL before disabling rails/clocks to avoid
power leakage (Krishna Chaitanya Chundru)
- Decide whether suspend should put the link in L2 and power down using
pci_host_common_d3cold_possible() instead of checking whether ASPM L1 is
enabled (Krishna Chaitanya Chundru)
- Add qcom D3cold support to tear down interconnect bandwidth and OPP votes
(Krishna Chaitanya Chundru)
- Handle unsupported mixed PERST#/PHY DT configurations, e.g., PHY in RP
node while PERST# is in the RC node, but warn about the DT issue (Qiang
Yu)
- Add pcie_encode_t_power_on() to encode L1SS T_POWER_ON fields (Krishna
Chaitanya Chundru)
- Add dw_pcie_program_t_power_on() to program T_POWER_ON (Krishna Chaitanya
Chundru)
- Program qcom T_POWER_ON based on DT 't-power-on-us' property in case
hardware advertises incorrect values (Krishna Chaitanya Chundru)
- Disable ASPM L0s for SA8775P (Shawn Guo)
- Initialize DWC MSI lock for firmware-managed ECAM hosts, which don't use
the dw_pcie_host_init() path that initializes the lock (Yadu M G)
* pci/controller/dwc-qcom:
PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts
PCI: qcom: Disable ASPM L0s for SA8775P
PCI: qcom: Program T_POWER_ON
PCI: dwc: Add dw_pcie_program_t_power_on() to program T_POWER_ON
PCI/ASPM: Add pcie_encode_t_power_on() helper to encode L1SS T_POWER_ON fields
PCI: qcom: Handle mixed PERST#/PHY DT configuration
PCI: qcom: Add D3cold support
PCI: dwc: Use common D3cold eligibility helper in suspend path
PCI: qcom: Power down PHY via PARF_PHY_CTRL before disabling rails/clocks
PCI: qcom: Add .get_ltssm() callback to query LTSSM status
PCI: host-common: Add pci_host_common_d3cold_possible() helper
PCI: qcom: Set max OPP before DBI access during resume
# Conflicts:
# drivers/pci/controller/pci-host-common.c
- Enable clock before PHY init for correct ordering (Florian Eckert)
- Add .start_link() callback so the driver works again (Florian Eckert)
- Stop overwriting the ATU base address discovered by
dw_pcie_get_resources() (Florian Eckert)
- Add DT 'atu' region since this is hardware-specific, and fall back to
driver default if lacking (Florian Eckert)
* pci/controller/dwc-intel-gw:
dt-bindings: PCI: intel,lgm-pcie: Add 'atu' resource
PCI: intel-gw: Fix ATU base address setup and add optional DT 'atu' region
PCI: intel-gw: Add .start_link() callback
PCI: intel-gw: Enable clock before PHY init
PCI: intel-gw: Move interrupt enable to own function
PCI: intel-gw: Remove unused PCIE_APP_INTX_OFST definition
- Move IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling into the core reset
functions (Richard Zhu)
- Add pci_host_common_parse_ports() for use by any native driver to parse
Root Port properties (currently only reset GPIOs) (Sherry Sun)
- Assert PERST# before enabling regulators to ensure that even if power is
enabled, endpoint stays inactive until REFCLK is stable (Sherry Sun)
- Parse reset properties in Root Port nodes (falling back to host bridge)
to help support Key E connectors and the pwrctrl framework (Sherry Sun)
- Configure i.MX95 REF_USE_PAD before PHY reset (Richard Zhu)
- Assert i.MX95 ref_clk_en after reference clock stabilizes (Richard Zhu)
- Integrate new pwrctrl API for DTs with Root Port-level power supplies
(Sherry Sun)
* pci/controller/dwc-imx6:
PCI: imx6: Integrate new pwrctrl API
PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95
PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95
PCI: imx6: Parse 'reset-gpios' in Root Port nodes
PCI: imx6: Assert PERST# before enabling regulators
PCI: host-generic: Add common helpers for parsing Root Port properties
dt-bindings: PCI: fsl,imx6q-pcie: Add reset GPIO in Root Port node
PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
- Assert PERST# on shutdown so any connected Endpoints are held in reset
during shutdown (Sai Krishna Musham)
* pci/controller/dwc-amd-mdb:
PCI: amd-mdb: Assert PERST# on shutdown
- Apply ECRC TLP Digest workaround for all DesignWare cores prior to 5.10a,
not just 4.90a and 5.00a (Manikanta Maddireddy)
- Use common struct dw_pcie 'mode' rather than duplicating it in artpec6,
dra7xx, dwc-pcie, and keembay driver structs (Hans Zhang)
- Use DEFINE_SHOW_ATTRIBUTE for ltssm_status debugfs to reduce boilerplate
and fix a seq_file memory leak by including a .release() callback (Hans
Zhang)
- Fix a signedness bug in fault injection test code (Dan Carpenter)
- Avoid NULL pointer dereference when tearing down debugfs for controller
that lacks RAS DES capability (Shuvam Pandey)
* pci/controller/dwc:
PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability
PCI: dwc: Fix signedness bug in fault injection test code
PCI: dwc: Use DEFINE_SHOW_ATTRIBUTE for ltssm_status debugfs
PCI: keembay: Use common mode field in struct dw_pcie
PCI: dwc: Use common mode field in struct dw_pcie
PCI: artpec6: Use common mode field in struct dw_pcie
PCI: dra7xx: Use common mode field in struct dw_pcie
PCI: dwc: Apply ECRC workaround for DesignWare cores prior to 5.10a
- Do not dispose of the parent IRQ mapping, which belongs to the parent
interrupt controller (Mahesh Vaidya)
- Fix chained IRQ handler ordering issue and resource leaks on probe
failure (Mahesh Vaidya)
* pci/controller/altera:
PCI: altera: Fix resource leaks on probe failure
PCI: altera: Do not dispose parent IRQ mapping
- Request bus reassignment when not probe-only to fix an enumeration
regression on Marvell CN106XX and possibly other DT-based systems
(Ratheesh Kannoth)
* pci/controller/host-common:
PCI: host-common: Request bus reassignment when not probe-only
- Add endpoint controller APIs for use by function drivers to discover
auxiliary blocks like DMA engines (Koichiro Den)
- Remember DesignWare eDMA engine base/size and expose them via the EPC
aux-resource API (Koichiro Den)
- Refactor endpoint doorbell allocation to allow non-MSI doorbells
(Koichiro Den)
- Add endpoint embedded doorbell fallback, used if MSI allocation fails
(Koichiro Den)
- Validate BAR index and remove dead BAR read in endpoint doorbell test
(Carlos Bilbao)
- Unwind MSI/MSI-X vectors if NTB initialization fails part-way through
(Koichiro Den)
- Cache sleepable pci_irq_vector() value at ISR setup to avoid calling it
from hardirq context (Koichiro Den)
- Validate doorbell count when configuring NTB and vNTB doorbells
(Manivannan Sadhasivam)
- Call sleepable pci_epc_raise_irq() from a work item instead of atomic
context, e.g., when setting bits in NTB peer doorbells in the
ntb_peer_db_set() path (Koichiro Den)
- Report 0-based vNTB doorbell vector to account for link event 0 and
historically skipped slot 1 (Koichiro Den)
- Reject unusable vNTB doorbell counts, e.g., if they don't allow space for
link event 0 and historically skipped slot 1 (Koichiro Den)
- Prevent configfs writes to vNTB db_count and other values that are
already in use after EPC attach (Koichiro Den)
- Account for vNTB db_valid reserved slots (link event 0 and historically
skipped slot 1) so they don't appear as valid doorbells (Koichiro Den)
- Implement vNTB .db_vector_count()/mask() for doorbells so clients can use
multiple vectors and avoid thundering herds (Koichiro Den)
- Report 0-based NTB doorbell vector to account for link event 0 and
historically skipped slot 1 (Koichiro Den)
- Fix doorbell bitmask and IRQ vector handling to clear only specified
bits, use the correct vector for non-contiguous Linux IRQ numbers, and
validate incoming vectors (Koichiro Den)
- Implement NTB .db_vector_count()/mask() for doorbells so clients can use
multiple vectors (Koichiro Den)
* pci/endpoint:
NTB: epf: Implement .db_vector_count()/mask() for doorbells
NTB: epf: Fix doorbell bitmask and IRQ vector handling
NTB: epf: Report 0-based doorbell vector via ntb_db_event()
NTB: epf: Make db_valid_mask cover only real doorbell bits
NTB: epf: Document legacy doorbell slot offset in ntb_epf_peer_db_set()
PCI: endpoint: pci-epf-vntb: Implement .db_vector_count()/mask() for doorbells
PCI: endpoint: pci-epf-vntb: Exclude reserved slots from db_valid_mask
PCI: endpoint: pci-epf-vntb: Guard configfs writes after EPC attach
PCI: endpoint: pci-epf-vntb: Reject unusable doorbell counts
PCI: endpoint: pci-epf-vntb: Report 0-based doorbell vector via ntb_db_event()
PCI: endpoint: pci-epf-vntb: Defer pci_epc_raise_irq() out of atomic context
PCI: endpoint: pci-epf-vntb: Document legacy MSI doorbell offset
PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0
PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0
NTB: epf: Avoid calling pci_irq_vector() from hardirq context
NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
misc: pci_endpoint_test: Remove dead BAR read before doorbell trigger
misc: pci_endpoint_test: Validate BAR index in doorbell test
PCI: endpoint: pci-ep-msi: Add embedded doorbell fallback
PCI: endpoint: pci-epf-test: Reuse pre-exposed doorbell targets
PCI: endpoint: pci-epf-vntb: Reuse pre-exposed doorbells and IRQ flags
PCI: endpoint: pci-ep-msi: Refactor doorbell allocation for new backends
PCI: dwc: ep: Expose integrated eDMA resources via EPC aux-resource API
PCI: dwc: Record integrated eDMA register window
PCI: endpoint: Add auxiliary resource query API
- Avoid FLR for MediaTek MT7925 WiFi, where FLR fails after a VM terminates
uncleanly (Jose Ignacio Tornos Martinez)
- Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems, which
seem not to support it correctly (Jose Ignacio Tornos Martinez)
* pci/virtualization:
PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems
PCI: Avoid FLR for MediaTek MT7925 WiFi
- Require CAP_SYS_ADMIN to write to sysfs 'resourceN_resize' attributes
(Krzysztof Wilczyński)
- Convert PCI resource files to static attributes to avoid races that cause
'duplicate filename' warnings and boot panics (Krzysztof Wilczyński)
- Remove pci_create_sysfs_dev_files() and pci_remove_sysfs_dev_files(),
which are obsolete after converting to static attributes (Krzysztof
Wilczyński)
- Add security_locked_down(LOCKDOWN_PCI_ACCESS) to alpha PCI resource mmap
path to match the generic path (Krzysztof Wilczyński)
- Convert sysfs 'legacy_io' and 'legacy_mem' to static attributes
(Krzysztof Wilczyński)
- Remove pci_create_legacy_files() and pci_sysfs_init(), which are obsolete
after converting to static attributes (Krzysztof Wilczyński)
- Expose sysfs 'resourceN_resize' attributes only on platforms with PCI
mmap (Krzysztof Wilczyński)
- Use kstrtobool() to parse the 'rom' attribute input to avoid the
unexpected behavior of enabling the ROM when writing '0' with no trailing
newline (Krzysztof Wilczyński)
* pci/sysfs:
PCI/sysfs: Use kstrtobool() to parse the ROM attribute input
PCI/sysfs: Limit BAR resize attribute scope to platforms with PCI mmap
PCI/sysfs: Remove pci_create_legacy_files() and pci_sysfs_init()
PCI/sysfs: Convert legacy I/O and memory attributes to static definitions
PCI/sysfs: Add __weak pci_legacy_has_sparse() helper
alpha/PCI: Compute legacy size in pci_mmap_legacy_page_range()
PCI: Add macros for legacy I/O and memory address space sizes
PCI/sysfs: Remove pci_{create,remove}_sysfs_dev_files()
alpha/PCI: Convert resource files to static attributes
alpha/PCI: Add static PCI resource attribute macros
alpha/PCI: Remove WARN from __pci_mmap_fits() and __legacy_mmap_fits()
alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
alpha/PCI: Use PCI resource accessor macros
alpha/PCI: Use BAR index in sysfs attr->private instead of resource pointer
alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
PCI/sysfs: Limit pci_sysfs_init() late_initcall compile scope
PCI/sysfs: Add stubs for pci_{create,remove}_sysfs_dev_files()
PCI/sysfs: Warn about BAR resize failure in __resource_resize_store()
PCI/sysfs: Convert PCI resource files to static attributes
PCI/sysfs: Add static PCI resource attribute macros
PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()
PCI/sysfs: Split pci_llseek_resource() for device and legacy attributes
PCI/sysfs: Only allow supported resource types in I/O and MMIO helpers
PCI: Add pci_resource_is_io() and pci_resource_is_mem() helpers
PCI/sysfs: Use PCI resource accessor macros
- Check option ROM header signatures and lengths before accessing to avoid
page faults and alignment faults (Guixin Liu)
* pci/rom:
PCI: Check ROM header and data structure addr before accessing
PCI: Introduce named defines for PCI ROM
- Log device readiness timeouts as errors, not warnings (Bjorn Helgaas)
- Wait for device readiness after soft reset (D3hot -> D0uninitialized
transition), when the device may respond with Request Retry Status if it
needs more time to initialize (Bjorn Helgaas)
- Drop unnecessary retries when restoring BARs (Lukas Wunner)
* pci/reset:
PCI: Drop unnecessary retries when restoring BARs
PCI: Wait for device readiness after D3hot -> D0uninitialized transition
PCI: Log device readiness timeouts as errors
Runyu Xiao
Xin Long
Jamal Hadi Salim
Jakub Kicinski
Jakub Sitnicki
Linus Torvalds
Namjae Jeon
Haofeng Li
Bjorn Helgaas