summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-01-17net: phy: realtek: simplify C22 reg access via MDIO_MMD_VEND2Daniel Golle
RealTek 2.5GE PHYs have all standard Clause-22 registers mapped also inside MDIO_MMD_VEND2 at offset 0xa400. This is used mainly in case the PHY is connected to a Clause-45-only bus. The RTL8221B is frequently used in copper SFP module which uses the RollBall MDIO-over-I2C method which *only* supports Clause-45, for example. In order to support using the PHY on Clause-45-only busses, the PHY driver has previously been split into a C22-only and C45-only instances, creating quite a bit of redundancy and confusion. In preparation of reunifying the two driver instances, add support for translating MDIO_MMD_VEND2 registers 0xa400 to 0xa43c back to Clause-22 registers 0 to 30 in case the PHY is accessed on a Clause-22 bus. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/fd49d86bd0445b76269fd3ea456c709c2066683f.1768275364.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: phy: realtek: support interrupt also for C22 variantsDaniel Golle
Now that access to MDIO_MMD_VEND2 works transparently also in Clause-22 mode, add interrupt support also for the C22 variants of the RTL8221B-VB-CG and RTL8221B-VM-CG. This results in the C22 and C45 driver instances now having all the same features implemented. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/7620084b1de01580edc2d0e1b9548507fb4643a8.1768275364.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: stmmac: fix dwmac4 transmit performance regressionRussell King (Oracle)
dwmac4's transmit performance dropped by a factor of four due to an incorrect assumption about which definitions are for what. This highlights the need for sane register macros. Commit 8409495bf6c9 ("net: stmmac: cores: remove many xxx_SHIFT definitions") changed the way the txpbl value is merged into the register: value = readl(ioaddr + DMA_CHAN_TX_CONTROL(dwmac4_addrs, chan)); - value = value | (txpbl << DMA_BUS_MODE_PBL_SHIFT); + value = value | FIELD_PREP(DMA_BUS_MODE_PBL, txpbl); With the following in the header file: #define DMA_BUS_MODE_PBL BIT(16) -#define DMA_BUS_MODE_PBL_SHIFT 16 The assumption here was that DMA_BUS_MODE_PBL was the mask for DMA_BUS_MODE_PBL_SHIFT, but this turns out not to be the case. The field is actually six bits wide, buts 21:16, and is called TXPBL. What's even more confusing is, there turns out to be a PBLX8 single bit in the DMA_CHAN_CONTROL register (0x1100 for channel 0), and DMA_BUS_MODE_PBL seems to be used for that. However, this bit et.al. was listed under a comment "/* DMA SYS Bus Mode bitmap */" which is for register 0x1004. Fix this up by adding an appropriately named field definition under the DMA_CHAN_TX_CONTROL() register address definition. Move the RPBL mask definition under DMA_CHAN_RX_CONTROL(), correctly renaming it as well. Also move the PBL bit definition under DMA_CHAN_CONTROL(), correctly renaming it. This removes confusion over the PBL fields. Fixes: 8409495bf6c9 ("net: stmmac: cores: remove many xxx_SHIFT definitions") Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Bisected-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://lore.kernel.org/51859704-57fd-4913-b09d-9ac58a57f185@bootlin.com Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/E1vgY1k-00000003vOC-0Z1H@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17Merge branch 'fou-gue-fix-skb-memleak-with-inner-protocol-0'Jakub Kicinski
Kuniyuki Iwashima says: ==================== fou/gue: Fix skb memleak with inner protocol 0. syzbot reported memleak for a GUE packet with its inner protocol number 0. Patch 1 fixes the issue, and patch 3 fixes the same issue in FOU. ==================== Link: https://patch.msgid.link/20260115172533.693652-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17fou: Don't allow 0 for FOU_ATTR_IPPROTO.Kuniyuki Iwashima
fou_udp_recv() has the same problem mentioned in the previous patch. If FOU_ATTR_IPPROTO is set to 0, skb is not freed by fou_udp_recv() nor "resubmit"-ted in ip_protocol_deliver_rcu(). Let's forbid 0 for FOU_ATTR_IPPROTO. Fixes: 23461551c0062 ("fou: Support for foo-over-udp RX path") Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260115172533.693652-4-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17tools: ynl: Specify --no-line-number in ynl-regen.sh.Kuniyuki Iwashima
If grep.lineNumber is enabled in .gitconfig, [grep] lineNumber = true ynl-regen.sh fails with the following error: $ ./tools/net/ynl/ynl-regen.sh -f ... ynl_gen_c.py: error: argument --mode: invalid choice: '4:' (choose from user, kernel, uapi) GEN 4: net/ipv4/fou_nl.c Let's specify --no-line-number explicitly. Fixes: be5bea1cc0bf ("net: add basic C code generators for Netlink") Suggested-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260115172533.693652-3-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17gue: Fix skb memleak with inner IP protocol 0.Kuniyuki Iwashima
syzbot reported skb memleak below. [0] The repro generated a GUE packet with its inner protocol 0. gue_udp_recv() returns -guehdr->proto_ctype for "resubmit" in ip_protocol_deliver_rcu(), but this only works with non-zero protocol number. Let's drop such packets. Note that 0 is a valid number (IPv6 Hop-by-Hop Option). I think it is not practical to encap HOPOPT in GUE, so once someone starts to complain, we could pass down a resubmit flag pointer to distinguish two zeros from the upper layer: * no error * resubmit HOPOPT [0] BUG: memory leak unreferenced object 0xffff888109695a00 (size 240): comm "syz.0.17", pid 6088, jiffies 4294943096 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 40 c2 10 81 88 ff ff 00 00 00 00 00 00 00 00 .@.............. backtrace (crc a84b336f): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4958 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x3b4/0x590 mm/slub.c:5270 __build_skb+0x23/0x60 net/core/skbuff.c:474 build_skb+0x20/0x190 net/core/skbuff.c:490 __tun_build_skb drivers/net/tun.c:1541 [inline] tun_build_skb+0x4a1/0xa40 drivers/net/tun.c:1636 tun_get_user+0xc12/0x2030 drivers/net/tun.c:1770 tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x45d/0x710 fs/read_write.c:686 ksys_write+0xa7/0x170 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 37dd0247797b1 ("gue: Receive side for Generic UDP Encapsulation") Reported-by: syzbot+4d8c7d16b0e95c0d0f0d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6965534b.050a0220.38aacd.0001.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260115172533.693652-2-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17docs: netdev: refine 15-patch limitSimon Horman
The 15 patch limit is intended by the maintainers to cover all outstanding patches on the mailing list on a per-tree basis. Not just those in a single patchset. Document this practice accordingly. Signed-off-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260115-15-minutes-of-fame-v2-1-70cbf0883aff@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17tcp: move tcp_rate_skb_sent() to tcp_output.cEric Dumazet
It is only called from __tcp_transmit_skb() and __tcp_retransmit_skb(). Move it in tcp_output.c and make it static. clang compiler is now able to inline it from __tcp_transmit_skb(). gcc compiler inlines it in the two callers, which is also fine. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Neal Cardwell <ncardwell@google.com> Link: https://patch.msgid.link/20260114165109.1747722-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17amd-xgbe: avoid misleading per-packet error logRaju Rangoju
On the receive path, packet can be damaged because of buffer overflow in Rx FIFO. Avoid misleading per-packet error log when packet->errors is set, this can flood the log. Instead, rely on the standard rtnl_link_stats64 stats. Fixes: c5aa9e3b8156 ("amd-xgbe: Initial AMD 10GbE platform driver") Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com> Link: https://patch.msgid.link/20260114163037.2062606-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: ethernet: ti: cpsw_ale: Remove obsolete macrosStefan Wiehler
- ALE_VERSION_MAJOR/MINOR are no longer used following the transition to regmaps in commit bbfc7e2b9ebe ("net: ethernet: ti: cpsw_ale: use regfields for ALE registers") - ALE_VERSION_IR3 is unused since entry mask bits are no longer hardcoded with commit b5d31f294027 ("net: ethernet: ti: ale: optimize ale entry mask bits configuartion") - ALE_VERSION_IR4 has never been used since its introduction in commit ca47130a744b ("net: netcp: ale: update to support unknown vlan controls for NU switch") Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com> Link: https://patch.msgid.link/20260114144425.3973272-1-stefan.wiehler@nokia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17octeontx2: Fix otx2_dma_map_page() error return codeThomas Fourier
0 is a valid DMA address [1] so using it as the error value can lead to errors. The error value of dma_map_XXX() functions is DMA_MAPPING_ERROR which is ~0. The callers of otx2_dma_map_page() use dma_mapping_error() to test the return value of otx2_dma_map_page(). This means that they would not detect an error in otx2_dma_map_page(). Make otx2_dma_map_page() return the raw value of dma_map_page_attrs(). [1] https://lore.kernel.org/all/f977f68b-cec5-4ab7-b4bd-2cf6aca46267@intel.com Fixes: caa2da34fd25 ("octeontx2-pf: Initialize and config queues") Cc: <stable@vger.kernel.org> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com> Link: https://patch.msgid.link/20260114123107.42387-2-fourier.thomas@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net/sched: cake: avoid separate allocation of struct cake_sched_configToke Høiland-Jørgensen
Paolo pointed out that we can avoid separately allocating struct cake_sched_config even in the non-mq case, by embedding it into struct cake_sched_data. This reduces the complexity of the logic that swaps the pointers and frees the old value, at the cost of adding 56 bytes to the latter. Since cake_sched_data is already almost 17k bytes, this seems like a reasonable tradeoff. Suggested-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Fixes: bc0ce2bad36c ("net/sched: sch_cake: Factor out config variables into separate struct") Link: https://patch.msgid.link/20260113143157.2581680-1-toke@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17docs: tls: Enhance TLS resync async process documentationShahar Shitrit
Expand the tls-offload.rst documentation to provide a more detailed explanation of the asynchronous resync process, including the role of struct tls_offload_resync_async in managing resync requests on the kernel side. Also, add documentation for helper functions tls_offload_rx_resync_async_request_start/ _end/ _cancel. Signed-off-by: Shahar Shitrit <shshitrit@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/1768298883-1602599-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17Merge branch 'uapi-use-uapi-definitions-of-int_max-and-int_min'Jakub Kicinski
Thomas Weißschuh says: ==================== uapi: Use UAPI definitions of INT_MAX and INT_MIN Using <limits.h> to gain access to INT_MAX and INT_MIN introduces a dependency on a libc, which UAPI headers should not do. Introduce and use equivalent UAPI constants. ==================== Link: https://patch.msgid.link/20260113-uapi-limits-v2-0-93c20f4b2c1a@linutronix.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17netfilter: uapi: Use UAPI definition of INT_MAX and INT_MINThomas Weißschuh
Using <limits.h> to gain access to INT_MAX and INT_MIN introduces a dependency on a libc, which UAPI headers should not do. Use the equivalent UAPI constants. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Link: https://patch.msgid.link/20260113-uapi-limits-v2-3-93c20f4b2c1a@linutronix.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17ethtool: uapi: Use UAPI definition of INT_MAXThomas Weißschuh
Using <limits.h> to gain access to INT_MAX introduces a dependency on a libc, which UAPI headers should not do. Use the equivalent UAPI constant. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Link: https://patch.msgid.link/20260113-uapi-limits-v2-2-93c20f4b2c1a@linutronix.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17uapi: add INT_MAX and INT_MIN constantsThomas Weißschuh
Some UAPI headers use INT_MAX and INT_MIN. Currently they include <limits.h> for their definitions, which introduces a problematic dependency on libc. Add custom, namespaced definitions of INT_MAX and INT_MIN using the same values as the regular kernel code. These definitions are not added to uapi/linux/limits.h, as that header will conflict with libc definitions on some platforms. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Link: https://patch.msgid.link/20260113-uapi-limits-v2-1-93c20f4b2c1a@linutronix.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: usb: sr9700: remove code to drive nonexistent MIIEthan Nelson-Moore
This device does not have a MII, even though the driver contains code to drive one (because it originated as a copy of the dm9601 driver). It also only supports 10Mbps half-duplex operation (the DM9601 registers to set the speed/duplex mode are read-only). Remove all MII-related code and implement sr9700_get_link_ksettings which returns hardcoded correct information for the link speed and duplex mode. Also add announcement of the link status like many other Ethernet drivers have. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Link: https://patch.msgid.link/20260113040649.54248-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17Merge branch 'net-pcs-rzn1-miic-support-configurable-phy_link-polarity'Jakub Kicinski
Lad Prabhakar says: ==================== net: pcs: rzn1-miic: Support configurable PHY_LINK polarity This series adds support for configuring the active level of MIIC PHY_LINK status signals on Renesas RZ/N1 and RZ/T2H/N2H platforms. The MIIC block provides dedicated hardware PHY_LINK signals that indicate EtherPHY link-up and link-down status independently of whether the MAC (GMAC) or Ethernet switch (ETHSW) is used. While GMAC-based systems typically obtain link state via MDIO and handle it in software, the ETHSW relies on these PHY_LINK pins for both CPU-assisted operation and switch-only forwarding paths that do not involve the host processor. These hardware PHY_LINK signals are particularly important for use cases requiring fast reaction to link-down events, such as redundancy protocols including Device Level Ring (DLR). In such scenarios, relying solely on software-based link detection introduces latency that can negatively impact recovery time. The ETHSW therefore exposes PHY_LINK signals to enable immediate hardware-level detection of cable or port failures. Some systems require the PHY_LINK signal polarity to be configured as active low rather than the default active high. This series introduces a new DT property to describe the required polarity and adds corresponding driver support to program the MIIC PHY_LINK register accordingly. The configuration is accumulated during DT parsing and applied once hardware initialization is complete, taking into account SoC-specific differences between RZ/N1 and RZ/T2H/N2H. ==================== Link: https://patch.msgid.link/20260112173555.1166714-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: pcs: rzn1-miic: Add PHY_LINK active-level configuration supportLad Prabhakar
Add support to configure the active level of MIIC PHY_LINK status signals on a per-converter basis using a DT property. MIIC provides dedicated PHY_LINK signals that indicate EtherPHY link-up and link-down status in hardware. These signals are required regardless of whether GMAC or ETHSW is used. With GMAC, link state is retrieved via MDC/MDIO and handled in software, while ETHSW relies on PHY_LINK pins for both CPU-assisted operation and switch-only data paths that do not involve the host. Hardware PHY_LINK signals are also critical for fast reaction to link-down events, for example when running redundancy protocols such as Device Level Ring (DLR), where rapid detection of cable faults is required to switch to an alternate path without software latency. Parse the requested polarity from DT, accumulate the configuration during probing, and apply it to the MIIC_PHY_LINK register once hardware initialization is complete, when the registers can be safely modified. Handle SoC-specific bit layout differences between RZ/N1 and RZ/T2H/N2H within the driver. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/20260112173555.1166714-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17dt-bindings: net: pcs: renesas,rzn1-miic: Add phy_link propertyLad Prabhakar
Add the renesas,miic-phy-link-active-low property to allow configuring the active level of phy_link status signals provided by the MIIC block. EtherPHY link-up and link-down status is required as a hardware IP feature independent of whether GMAC or ETHSW is used. With GMAC, link state is retrieved via MDC/MDIO and handled in software. In contrast, ETHSW exposes dedicated PHY_LINK pins that provide this information directly in hardware. These PHY_LINK signals are required not only for host-controlled traffic but also for switch-only forwarding paths where frames are exchanged between external nodes without CPU involvement. This is particularly important for redundancy protocols such as DLR (Device Level Ring), which depend on fast detection of link-down events caused by cable or port failures. Handling such events purely in software introduces latency, which is why ETHSW provides dedicated hardware PHY_LINK pins. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260112173555.1166714-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17mctp i2c: initialise event handler read bytesMatt Johnston
Set a 0xff value for i2c reads of an mctp-i2c device. Otherwise reads will return "val" from the i2c bus driver. For i2c-aspeed and i2c-npcm7xx that is a stack uninitialised u8. Tested with "i2ctransfer -y 1 r10@0x34" where 0x34 is a mctp-i2c instance, now it returns all 0xff. Fixes: f5b8abf9fc3d ("mctp i2c: MCTP I2C binding driver") Signed-off-by: Matt Johnston <matt@codeconstruct.com.au> Link: https://patch.msgid.link/20260113-mctp-read-fix-v1-1-70c4b59c741c@codeconstruct.com.au Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INITXin Long
A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails: ================================================================== KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 0 PID: 16 Comm: ksoftirqd/0 Tainted: G W 6.6.0 #2 RIP: 0010:sctp_packet_bundle_auth net/sctp/output.c:264 [inline] RIP: 0010:sctp_packet_append_chunk+0xb36/0x1260 net/sctp/output.c:401 Call Trace: sctp_packet_transmit_chunk+0x31/0x250 net/sctp/output.c:189 sctp_outq_flush_data+0xa29/0x26d0 net/sctp/outqueue.c:1111 sctp_outq_flush+0xc80/0x1240 net/sctp/outqueue.c:1217 sctp_cmd_interpreter.isra.0+0x19a5/0x62c0 net/sctp/sm_sideeffect.c:1787 sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline] sctp_do_sm+0x1a3/0x670 net/sctp/sm_sideeffect.c:1169 sctp_assoc_bh_rcv+0x33e/0x640 net/sctp/associola.c:1052 sctp_inq_push+0x1dd/0x280 net/sctp/inqueue.c:88 sctp_rcv+0x11ae/0x3100 net/sctp/input.c:243 sctp6_rcv+0x3d/0x60 net/sctp/ipv6.c:1127 The issue is triggered when sctp_auth_asoc_init_active_key() fails in sctp_sf_do_5_1C_ack() while processing an INIT_ACK. In this case, the command sequence is currently: - SCTP_CMD_PEER_INIT - SCTP_CMD_TIMER_STOP (T1_INIT) - SCTP_CMD_TIMER_START (T1_COOKIE) - SCTP_CMD_NEW_STATE (COOKIE_ECHOED) - SCTP_CMD_ASSOC_SHKEY - SCTP_CMD_GEN_COOKIE_ECHO If SCTP_CMD_ASSOC_SHKEY fails, asoc->shkey remains NULL, while asoc->peer.auth_capable and asoc->peer.peer_chunks have already been set by SCTP_CMD_PEER_INIT. This allows a DATA chunk with auth = 1 and shkey = NULL to be queued by sctp_datamsg_from_user(). Since command interpretation stops on failure, no COOKIE_ECHO should been sent via SCTP_CMD_GEN_COOKIE_ECHO. However, the T1_COOKIE timer has already been started, and it may enqueue a COOKIE_ECHO into the outqueue later. As a result, the DATA chunk can be transmitted together with the COOKIE_ECHO in sctp_outq_flush_data(), leading to the observed issue. Similar to the other places where it calls sctp_auth_asoc_init_active_key() right after sctp_process_init(), this patch moves the SCTP_CMD_ASSOC_SHKEY immediately after SCTP_CMD_PEER_INIT, before stopping T1_INIT and starting T1_COOKIE. This ensures that if shared key generation fails, authenticated DATA cannot be sent. It also allows the T1_INIT timer to retransmit INIT, giving the client another chance to process INIT_ACK and retry key setup. Fixes: 730fc3d05cd4 ("[SCTP]: Implete SCTP-AUTH parameter processing") Reported-by: Zhen Chen <chenzhen126@huawei.com> Tested-by: Zhen Chen <chenzhen126@huawei.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/44881224b375aa8853f5e19b4055a1a56d895813.1768324226.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17dt-bindings: mailbox: qcom: Add IPCC support for Kaanapali and Glymur PlatformsJingyi Wang
Document the Inter-Processor Communication Controller on the Qualcomm Kaanapali and Glymur Platforms, which will be used to route interrupts across various subsystems found on the SoC. Co-developed-by: Sibi Sankar <sibi.sankar@oss.qualcomm.com> Signed-off-by: Sibi Sankar <sibi.sankar@oss.qualcomm.com> Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com> Reviewed-by: Bjorn Andersson <andersson@kernel.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/20251031-knp-ipcc-v3-1-62ffb4168dff@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-01-17clk: imx: fracn-gppll: Add 241.90 MHz SupportMarco Felsch
Some parallel panels have a pixelclk of 24.19 MHz. Add support for 241.90 MHz so a by 10 divider can be used to derive the exact pixelclk. Signed-off-by: Marco Felsch <m.felsch@pengutronix.de> Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Acked-by: Daniel Baluta <daniel.baluta@nxp.com> Link: https://patch.msgid.link/20260113-v6-18-topic-clk-fracn-gppll-v3-2-45da70f43c98@pengutronix.de Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
2026-01-17clk: imx: fracn-gppll: Add 332.60 MHz SupportMarco Felsch
Some parallel panels have a pixelclk of 33.260 MHz. Add support for 332.60 MHz so a by 10 divider can be used to derive the exact pixelclk. Reviewed-by: Primoz Fiser <primoz.fiser@norik.com> Signed-off-by: Marco Felsch <m.felsch@pengutronix.de> Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Acked-by: Daniel Baluta <daniel.baluta@nxp.com> Link: https://patch.msgid.link/20260113-v6-18-topic-clk-fracn-gppll-v3-1-45da70f43c98@pengutronix.de Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
2026-01-17arm64: dts: exynos: gs101: add cmu_dpu and sysreg_dpu dt nodesPeter Griffin
Enable the cmu_dpu clock management unit. It feeds some of the display IPs. Additionally add the sysreg_dpu node which contains the BUSCOMPONENT_DRCG_EN and MEMCLK registers required by cmu_dpu to enable dynamic root clock gating of bus components. Reviewed-by: André Draszik <andre.draszik@linaro.org> Signed-off-by: Peter Griffin <peter.griffin@linaro.org> Link: https://patch.msgid.link/20260113-dpu-clocks-v3-5-cb85424f2c72@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-01-17Merge branch 'for-v6.20/dt-bindings-clk' into next/dt64Krzysztof Kozlowski
Merge clock DT binding headers from topic branch.
2026-01-17clk: samsung: gs101: add support for Display Process Unit (DPU) clocksPeter Griffin
cmu_dpu is the clock management unit used for the Display Process Unit block. It generates clocks for image scaler, compressor etc. Add support for the muxes, dividers and gates in cmu_dpu. Signed-off-by: Peter Griffin <peter.griffin@linaro.org> Reviewed-by: André Draszik <andre.draszik@linaro.org> Link: https://patch.msgid.link/20260113-dpu-clocks-v3-4-cb85424f2c72@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-01-17dt-bindings: samsung: exynos-sysreg: add gs101 dpu compatiblePeter Griffin
Add dedicated compatibles for gs101 dpu sysreg controllers to the documentation. Reviewed-by: André Draszik <andre.draszik@linaro.org> Signed-off-by: Peter Griffin <peter.griffin@linaro.org> Acked-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260113-dpu-clocks-v3-3-cb85424f2c72@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-01-17Merge branch 'for-v6.20/dt-bindings-clk' into next/clkKrzysztof Kozlowski
Merge DT binding headers from topic branch, used by the driver.
2026-01-17dt-bindings: clock: google,gs101-clock: Add DPU clock management unitPeter Griffin
Add dt schema documentation and clock IDs for the Display Process Unit (DPU) clock management unit (CMU). This CMU feeds IPs such as image scaler, enhancer and compressor. Signed-off-by: Peter Griffin <peter.griffin@linaro.org> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Reviewed-by: André Draszik <andre.draszik@linaro.org> Link: https://patch.msgid.link/20260113-dpu-clocks-v3-2-cb85424f2c72@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-01-17dt-bindings: clock: google,gs101-clock: fix alphanumeric orderingPeter Griffin
Ensure children of cmu_top have alphanumeric ordering. Top is special as it feeds all the other children CMUs. This ordering then matches the clk-gs101.c file. Reviewed-by: André Draszik <andre.draszik@linaro.org> Signed-off-by: Peter Griffin <peter.griffin@linaro.org> Acked-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260113-dpu-clocks-v3-1-cb85424f2c72@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-01-17clk: samsung: fix sysreg save/restore when PM is enabled for CMUAndré Draszik
Currently, sysreg registers of a CMU that has PM and automatic clock gating enabled are not saved / restored during runtime PM (RPM) or s2idle. During normal suspend, they are accessed too late, after the CMU (and potentially power domain) have been shut down, causing an SError. The reason is that these registers are registered to be saved/restored via a syscore suspend handler which doesn't run during RPM or s2idle. During normal suspend, this handler runs after the CMU has been shut down. This registration happens as part of samsung_clk_extended_sleep_init() via samsung_en_dyn_root_clk_gating(). When PM is enabled for a CMU, registers must be saved/restored via exynos_arm64_cmu_suspend() / exynos_arm64_cmu_resume() respectively instead. These use their own data structures and are unrelated to anything that samsung_clk_extended_sleep_init() does. Calling it unconditionally from samsung_en_dyn_root_clk_gating() therefore isn't useful. Update the code to prepare sysreg save / restore in a similar way to how it handles other clock registers in the PM case already. exynos_arm64_cmu_suspend() / exynos_arm64_cmu_resume() already handle sysreg save/restore, just the setup was incorrect. Fixes: 298fac4f4b96 ("clk: samsung: Implement automatic clock gating mode for CMUs") Signed-off-by: André Draszik <andre.draszik@linaro.org> Reviewed-by: Peter Griffin <peter.griffin@linaro.org> Link: https://patch.msgid.link/20260109-clk-samsung-autoclk-updates-v1-2-2394dcf242a9@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-01-17clk: samsung: avoid warning message on legacy Exynos (auto clock gating)André Draszik
We currently print a warning message that the IO memory size is not compatible with automatic clock gating for many Exynos-based boards, including legacy ones, even if not requested to enable automatic clock gating in the first place. Change the test in question to avoid that warning. Fixes: 298fac4f4b96 ("clk: samsung: Implement automatic clock gating mode for CMUs") Reported-by: Marek Szyprowski <m.szyprowski@samsung.com> Closes: https://lore.kernel.org/all/8b2c412d-3e1e-4be0-a9d5-ef67f6f0d409@samsung.com/ Suggested-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: André Draszik <andre.draszik@linaro.org> Reviewed-by: Peter Griffin <peter.griffin@linaro.org> Link: https://patch.msgid.link/20260109-clk-samsung-autoclk-updates-v1-1-2394dcf242a9@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-01-17MAINTAINERS: pstore: Remove L: entryKees Cook
A lot of SoC series end up getting CCed to the hardening list due to their mention of "pstore" in device tree or similar, and this noise isn't worth making sure I don't lose pstore patches by having them show up in the hardening patchwork. ;) I can use better email filters instead! Link: https://patch.msgid.link/20260116005631.work.387-kees@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
2026-01-17nfp: tls: Avoid -Wflex-array-member-not-at-end warningsGustavo A. R. Silva
-Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. So, in order to avoid ending up with flexible-array members in the middle of other structs, we use the `struct_group_tagged()` helper to separate the flexible array from the rest of the members in the flexible structure. We then use the newly created tagged `struct nfp_crypto_req_add_front_hdr` to replace the type of the objects causing trouble in a couple of structures. We also want to ensure that when new members need to be added to the flexible structure, they are always included within the newly created tagged struct. For this, we use `static_assert()`. This ensures that the memory layout for both the flexible structure and the new tagged struct is the same after any changes. Lastly, use container_of() to retrieve a pointer to the flexible structure and, through that, access the flexible-array member when needed. So, with these changes, fix the following warnings: drivers/net/ethernet/netronome/nfp/nfd3/../crypto/fw.h:58:41: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/ethernet/netronome/nfp/nfd3/../crypto/fw.h:65:41: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://patch.msgid.link/aSfDqouLFcA4h8JX@kspp Signed-off-by: Kees Cook <kees@kernel.org>
2026-01-17carl9170: Avoid -Wflex-array-member-not-at-end warningGustavo A. R. Silva
-Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declaration (which happens to be in a union, so we're moving the entire union) to the end of the corresponding structure. Notice that `struct carl9170_rsp` is a flexible structure, this is a structure that contains a flexible-array member. With these changes fix the following warning: drivers/net/wireless/ath/carl9170/carl9170.h:382:9: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Acked-by: Christian Lamparter <chunkeey@gmail.com> Link: https://patch.msgid.link/aR1yxjmzb2DM2-Uq@kspp Signed-off-by: Kees Cook <kees@kernel.org>
2026-01-17coredump: Use __counted_by_ptr for struct core_name::corenameKees Cook
Use the __counted_by annotation now available for struct pointer members, __counted_by_ptr(). Move assignments to immediately after allocation. Link: https://patch.msgid.link/20251020220118.1226740-3-kees@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
2026-01-17lkdtm/bugs: Add __counted_by_ptr() test PTR_BOUNDSKees Cook
Provide run-time validation of the __counted_by_ptr() annotation via newly added PTR_BOUNDS LKDTM test. Link: https://patch.msgid.link/20251020220118.1226740-2-kees@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
2026-01-17compiler_types.h: Attributes: Add __counted_by_ptr macroBill Wendling
Introduce __counted_by_ptr(), which works like __counted_by(), but for pointer struct members. struct foo { int a, b, c; char *buffer __counted_by_ptr(bytes); short nr_bars; struct bar *bars __counted_by_ptr(nr_bars); size_t bytes; }; Because "counted_by" can only be applied to pointer members in very recent compiler versions, its application ends up needing to be distinct from flexibe array "counted_by" annotations, hence a separate macro. This is a reworking of Kees' previous patch [1]. Link: https://lore.kernel.org/all/20251020220118.1226740-1-kees@kernel.org/ [1] Co-developed-by: Kees Cook <kees@kernel.org> Signed-off-by: Bill Wendling <morbo@google.com> Link: https://patch.msgid.link/20260116005838.2419118-1-morbo@google.com Signed-off-by: Kees Cook <kees@kernel.org>
2026-01-17hwmon: (dell-smm) Add Dell G15 5510 to fan control whitelistleobannocloutier@gmail.com
On the Dell G15 5510, fans spin at maximum speed when AC power is connected. This behavior has been observed as a regression in recent kernels (v6.18+). Add the Dell G15 5510 to the fan control whitelist to enable manual fan control and resolve the issue. This model requires the same fan control configuration as the Dell G15 5511. Fixes: 1c1658058c99 ("hwmon: (dell-smm) Add support for automatic fan mode") Signed-off-by: Leo Banno-Cloutier <leobannocloutier@gmail.com> Link: https://lore.kernel.org/r/20260117015315.214569-2-leobannocloutier@gmail.com [groeck: Updated patch description to follow guidance] Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-01-17ntb: transport: Fix uninitialized mutexDave Jiang
When the mutex 'link_event_lock' was introduced, it was never initialized and it triggers kernel warnings when used with locking debug turned on. Add initialization for the mutex. Fixes: 3db835dd8f9a ("ntb: Add mutex to make link_event_callback executed linearly.") Cc: fuyuanli <fuyuanli0722@gmail.com> Signed-off-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Jon Mason <jdmason@kudzu.us>
2026-01-17Merge tag 'arm64-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: "An arm64/mpam fix to use non-atomic bitops on struct mmap_props member (atomicity not required). For kunit testing, the structure is packed to avoid memcmp() errors but this affects atomic bitops as they have strict alignment requirements. Also remove a duplicate include in the mpam driver" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm_mpam: Use non-atomic bitops when modifying feature bitmap arm_mpam: Remove duplicate linux/srcu.h header
2026-01-17x86/acpi: Add acpi=spcr to use SPCR-provided default consoleShenghao Yang
The SPCR provided console on x86 is only available as a boot console when earlycon is provided on the kernel command line, and will not be present in /proc/consoles. While it's possible to retain the boot console with the keep_bootcon parameter, that leaves the console using the less efficient 8250_early driver. Users wanting to use the firmware suggested console (to avoid maintaining unique serial console parameters for different server models in large fleets) with the conventional driver have to parse the kernel log for the console parameters and reinsert them. [ 0.005091] ACPI: SPCR 0x000000007FFB5000 000059 (v04 ALASKA A M I 01072009 INTL 20250404) [ 0.073387] ACPI: SPCR: console: uart,io,0x3f8,115200 In commit 0231d00082f6 ("ACPI: SPCR: Make SPCR available to x86")¹ the SPCR console was only added as an option for earlycon but not as an ordinary console so users don't see console output changes. So users can opt in to an automatic SPCR console, make ACPI init add it if acpi=spcr is set. ¹https://lore.kernel.org/lkml/20180118150951.28964-1-prarit@redhat.com/ [ bp: Touchups. ] Signed-off-by: Shenghao Yang <me@shenghaoyang.info> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/20260117072827.355360-1-me@shenghaoyang.info
2026-01-17of: fix reference count leak in of_alias_scan()Weigang He
of_find_node_by_path() returns a device_node with its refcount incremented. When kstrtoint() fails or dt_alloc() fails, the function continues to the next iteration without calling of_node_put(), causing a reference count leak. Add of_node_put(np) before continue on both error paths to properly release the device_node reference. Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id") Cc: stable@vger.kernel.org Signed-off-by: Weigang He <geoffreyhe2@gmail.com> Link: https://patch.msgid.link/20260117091238.481243-1-geoffreyhe2@gmail.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-01-17s390/pci: Use PCIBIOS return values in pci_read()/pci_write()Niklas Schnelle
While pci_read() and pci_write() have returned errno values since their inception with commit cd24834130ac ("s390/pci: base support") other config accessors in particular pci_generic_config_read() as well as pci_generic_config_write() return specific error values which are then converted to errno by pcibios_err_to_errno(). Since latter does handle the case where the error value already looks like an errno the previous behavior is unlikely to cause actual issues. Still, for consistency and in case any caller explicitly checks error values align pci_read() and pci_write() with the generic accessors. Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com> Reviewed-by: Farhan Ali <alifm@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-01-17s390/pci: Handle futile config accesses of disabled devices directlyNiklas Schnelle
On s390 PCI busses and slots with multiple functions may have holes because PCI functions are passed-through by the hypervisor on a per function basis and some functions may be in standby or reserved. This fact is indicated by returning true from the hypervisor_isolated_pci_functions() helper and triggers common code to scan all possible devfn values. Via pci_scan_single_device() this in turn causes config reads for the device and vendor IDs, even for PCI functions which are in standby and thereofore disabled. So far these futile config reads, as well as potentially writes, which can never succeed were handled by the PCI load/store instructions themselves. This works as the platform just returns an error for a disabled and thus not usable function handle. It does cause spamming of error logs and additional overhead though. Instead check if the used function handle is enabled in zpci_cfg_load() and zpci_cfg_write() and if not enable directly return -ENODEV. Also refactor zpci_cfg_load() and zpci_cfg_store() slightly to accommodate the new logic while meeting modern kernel style guidelines. Cc: stable@vger.kernel.org Fixes: a50297cf8235 ("s390/pci: separate zbus creation from scanning") Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com> Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Reviewed-by: Farhan Ali <alifm@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-01-17Merge branch 'preempt'Heiko Carstens
Heiko Carstens says: ==================== The option to select PREEMPT_NONE will go away for all architectures which support PREEMPT_LAZY [1]. Until now all distributions provide kernels built with PREEMPT_NONE enabled for s390. In particular this means that all preempt_disable() / preempt_enable() pairs are optimized away during compile time. With PREEMPT_LAZY this is not the case. Switching to PREEMPT_LAZY leads to a kernel image size increase of ~218kb (defconfig, gcc15). s390 provides optimized preempt primitives, however there is still room for improvement. Since support for relocatable lowcore was added access to preempt_count in lowcore requires an extra call of get_lowcore(), which generates an extra instruction. Also all instructions have to use a base register which is not zero to access preempt_count. Address this by adding a couple of inline assemblies with alternatives. This generates better code and reduces the size of a PREEMPT_LAZY built kernel image by ~58kb. [1] https://lore.kernel.org/all/20251219101502.GB1132199@noisy.programming.kicks-ass.net/ ==================== Signed-off-by: Heiko Carstens <hca@linux.ibm.com>