Commit Graph

7163 Commits

Author SHA1 Message Date
Rosen Penev
b11c513ad9 gpio: mvebu: free generic chips on unbind
irq_alloc_domain_generic_chips() allocates generic chip data that must
be freed via irq_domain_remove_generic_chips(). The devres action
mvebu_gpio_remove_irq_domain() only called irq_domain_remove(), which
only frees the generic chips if IRQ_DOMAIN_FLAG_DESTROY_GC is set.
Call irq_domain_remove_generic_chips() explicitly before
irq_domain_remove() instead.

Fixes: 812d47889a ("gpio/mvebu: Use irq_domain_add_linear")
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260707232358.1218077-1-rosenp@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-08 14:05:11 +02:00
Liang Hao
aaf7766ba3 gpio: dwapb: Mask interrupts at hardware initialization
GPIO interrupts may retain stale state across warm reboots when
peripherals remain powered. If a GPIO line is not explicitly
configured for interrupts, this can result in interrupt storms
due to missing handlers.

Fix this by ensuring all interrupts are masked and disabled at
hardware initialization time via the init_hw() callback. Pending
interrupts are also cleared to start from a known-safe state.

Interrupts will be unmasked only when explicitly configured by
userspace or kernel drivers.

Signed-off-by: Liang Hao <haohlliang@gmail.com>
Link: https://patch.msgid.link/20260705074759.47863-1-haohlliang@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-07 14:32:01 +02:00
Jia Wang
d775b9451e gpio: dwapb: Defer clock gating until noirq
GPIO consumers such as gpio-keys can enable IRQ wake and adjust the wake
trigger type from their suspend callbacks. If the DWAPB controller suspends
first, masking interrupts and disabling its clocks in the normal suspend
phase prevents that late wake configuration from reliably reaching the
hardware. Systems with real DWAPB bus clocks then fail to wake from s2idle
through GPIO keys.

Save the register context in the normal suspend callback, but defer IRQ
masking and clock gating until suspend_noirq. At that point all consumers
have finished configuring wake IRQs, so keep the clocks enabled when wake
lines are armed and only gate them when no wake source is active.
Resume_noirq reenables clocks, if they were gated, before the normal resume
path restores registers.

Propagate wake requests to the parent irqchip while keeping the local wake
mask in sync with failures.

Fixes: 6437c7ba69 ("gpio: dwapb: Add wakeup source support")
Signed-off-by: Jia Wang <wangjia@ultrarisc.com>
Link: https://patch.msgid.link/20260702-gpio-dwapb-wakeup-v2-1-203f2f33429f@ultrarisc.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-07 14:30:50 +02:00
Bartosz Golaszewski
b30973e8c3 gpio: shared: make the voting mechanism adaptable
The current voting mechanism in GPIO shared proxy assumes that "low" is
always the default value and users can only vote for driving the GPIO
"high" in which case it will remain high as long as there's at least one
user voting.

This makes it impossible to use the automatic sharing management for
certain use-cases such as the write-protect GPIOs of EEPROMs which are
requested "high" and driven "low" to enable writing. In this case, if
the WP GPIO is shared by multiple EEPROMs, and at least one of them
wants to enable writing, the pin must be set to "low".

Modify the voting heuristic to assume the value set by the first user on
request to be the "default" and subseqent calls to gpiod_set_value()
will constitute votes for a change of the value to the opposite. In the
wp-gpios case it will mean that the nvmem core requests the GPIO as
"out-high" for all EEPROMs sharing the pin, and when one of them wants
to write, the pin will be driven low, enabling it.

Fixes: e992d54c6f ("gpio: shared-proxy: implement the shared GPIO proxy driver")
Reported-by: Marek Vasut <marex@nabladev.com>
Closes: https://lore.kernel.org/all/20260511163518.51104-1-marex@nabladev.com/
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260630-gpio-shared-dynamic-voting-v3-1-8ecf0542953b@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-06 15:26:17 +02:00
Andreas Kemnade
db4a79713e gpios: palmas: add .get_direction() op
Accessing debug/gpio is quite noisy without a get_direction()
implementation. To calm that down add an implementation.

Fixes: 3d50a27852 ("gpio: palmas: Add support for Palmas GPIO")
Cc: stable@vger.kernel.org
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://patch.msgid.link/20260704-palmas-getdirection-v2-1-2fd85fee3832@kemnade.info
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-06 12:01:07 +02:00
Linus Torvalds
2916bfc6ba gpio fixes for v7.2-rc2
- check the return value of gpiochip_add_data() in gpio-mvebu and
   gpio-htc-egpio
 - avoid locking context issues with GPIO drivers using the shared GPIO
   proxy by only allowing sleeping operations (atomic GPIO ops don't
   really make sense in shared context anyway)
 - with the above: restoe non-sleeping GPIO access in pinctrl-meson
 - fix return value on OOM in gpio-timberdale
 - fix interrupt handling in gpio-mt7621
 - support both A and B variants of NCT6126D in gpio-f7188x
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmpHaxAACgkQBZ0uy/82
 hMMo+Q/+MPDFUmy4E7mA1FwcJ1jwx4sFp7tIVu5jAjlC9GyrRJXxN6IS4od4RcqP
 x6r+FU+2j8G1Fyob6kh7nvsjsvNFkGkHToMIzJLaR/BNCQe3JhU/ipNx8rQ5OOHN
 lFBUfax0NoodxXbCftn3FHtvvLjNuRMTq9i0OkmoNgtqvuGmPFI4Zv/M3NdR/+bA
 hvv4cmdnQFNceX2FNTo5tcOyDyuAsrt+2oguE8zgLoLXKXk4E5NTrtxUVlyOCtPD
 43WpqoLC1nZJQZ2pK7Tfh4vjSlKl78ybhSEk9i/h9N+8fjWfWYQfYnT+akmi5oou
 LhDrg2k7AD4tJUJX1TPJofCnRM5F/qTPkxliXzzsi6zzMGpoKuLTejDEuY4Vl5D3
 TRk5lMi6yoorNtaKKmpDzflbpFZlnNvn7BE1KrUgYp/w1Vm8sEPfva87rSH+yYj/
 AhDnJvm9c6A6vsb58RO0h4QMArzq71BIR8S1fA7P5AFDyUk2EEBM3RZGdJfCo61c
 8/2PoYvRJWvlHsRlPmY/eWsOq25RE2fUEjpVI5PV8C9z+QFFM6gW+6QSZjbnWrtA
 Bdph8+549oWtPwCmx1CmdM5vxMOkuLYU/B7fdWAjzgL/YtIbM93+KLuzh9eblUpr
 eOKRxHIZoOb09Zcte4ke8wFckbCCEN3HmDIl+2TSgVG8i1L3FS8=
 =Q09c
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - check the return value of gpiochip_add_data() in gpio-mvebu and
   gpio-htc-egpio

 - avoid locking context issues with GPIO drivers using the shared GPIO
   proxy by only allowing sleeping operations (atomic GPIO ops don't
   really make sense in shared context anyway)

 - with the above: restore non-sleeping GPIO access in pinctrl-meson

 - fix return value on OOM in gpio-timberdale

 - fix interrupt handling in gpio-mt7621

 - support both A and B variants of NCT6126D in gpio-f7188x

* tag 'gpio-fixes-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  pinctrl: meson: restore non-sleeping GPIO access
  gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
  gpio: mt7621: be sure IRQ domain is created before exposing GPIO chips
  gpio: mt7621: more robust management of IRQ domain teardown
  gpio: mt7621: avoid corruption of shared interrupt trigger state
  gpio: shared-proxy: always serialize with a sleeping mutex
  gpio-f7188x: Add support for NCT6126D version B
  gpio: htc-egpio: use managed gpiochip registration
  gpio: mvebu: fail probe if gpiochip registration fails
2026-07-03 05:38:12 -10:00
Uwe Kleine-König (The Capable Hub)
995832b2ce Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
Replace the #include of <linux/mod_devicetable.h> by the more specific
<linux/device-id/*.h> where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:17 +02:00
Vladimir Zapolskiy
8d7e62d5e9 gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
Out of memory situation on driver's probe is expected to be reported to
the driver's framework with a proper -ENOMEM error code.

Fixes: 35570ac603 ("gpio: add GPIO driver for the Timberdale FPGA")
Signed-off-by: Vladimir Zapolskiy <vz@kernel.org>
Link: https://patch.msgid.link/20260630145148.4081967-1-vz@kernel.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-01 09:21:21 +02:00
Sergio Paracuellos
0e024f5829 gpio: mt7621: be sure IRQ domain is created before exposing GPIO chips
Function 'mediatek_gpio_bank_probe()' registers three GPIO chips using
'devm_gpiochip_add_data()'. At this point, the chips become live and visible
to consumers. However, the IRQ domain isn't allocated and set up until
'mt7621_gpio_irq_setup()' is called after the GPIO chips setup finishes.
If a consumer requests a GPIO IRQ concurrently 'mt7621_gpio_to_irq()' can
be called and pass a NULL irq domain pointer irq_create_mapping(), that can
corrupt the mappings or cause a crash. Fix this possible problem seting up
irq domain before GPIO chips setup is performed.

Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: a46f2e5720 ("gpio: mt7621: fix interrupt banks mapping on gpio chips")
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Link: https://patch.msgid.link/20260626060112.2498324-4-sergio.paracuellos@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-30 16:36:35 +02:00
Sergio Paracuellos
839738536a gpio: mt7621: more robust management of IRQ domain teardown
The driver uses devm_gpiochip_add_data() to register the GPIO chips which
means the devres subsystem will unregister them only after the function
'mt7621_gpio_remove()' returns. During the window between domain destruction
and devres unregistering the GPIO chips, the chips are still fully active.
If a consumer or userspace invokes gpiod_to_irq() during this window,
'mt7621_gpio_to_irq()' can dereference the already-freed irq domain pointer.
Thus, manage the IRQ domain teardown using 'devm_add_action_or_reset()' to
guarantee it is destroyed strictly after the GPIO chips are removed.

Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: a46f2e5720 ("gpio: mt7621: fix interrupt banks mapping on gpio chips")
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Link: https://patch.msgid.link/20260626060112.2498324-3-sergio.paracuellos@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-30 16:36:34 +02:00
Sergio Paracuellos
1781172526 gpio: mt7621: avoid corruption of shared interrupt trigger state
The bank-shared fields like 'rising' and 'falling' are modified using
non-atomic read-modify-write operations. Since every gpio chip instance
represents an entire bank of 32 pins, if 'mediatek_gpio_irq_type()' is
called concurrently for different IRQs on the same bank a possible overwrite
of each other's configuration is possible. Thus, protect this state with
'gpio_generic_lock_irqsave' lock in the same way it is handled in irp_chip
'mediatek_gpio_irq_mask()' and 'mediatek_gpio_irq_unmask()' callbacks.

Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 4ba9c3afda ("gpio: mt7621: Add a driver for MT7621")
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Link: https://patch.msgid.link/20260626060112.2498324-2-sergio.paracuellos@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-30 16:36:34 +02:00
Viacheslav Bocharov
efecde8a25 gpio: shared-proxy: always serialize with a sleeping mutex
The shared GPIO descriptor used either a mutex or a spinlock, chosen at
runtime from the underlying chip's can_sleep:

	shared_desc->can_sleep = gpiod_cansleep(shared_desc->desc);
	... if (can_sleep) mutex_lock(); else spin_lock_irqsave();

can_sleep describes only the value path (->get/->set). Under the same
lock, however, the proxy may call gpiod_set_config() and
gpiod_direction_*(), which can reach pinctrl paths that take a mutex
(e.g. gpiod_set_config() -> gpiochip_generic_config() ->
pinctrl_gpio_set_config()), independent of can_sleep. On a controller
with non-sleeping MMIO value ops the descriptor lock was a spinlock, so
the sleeping pinctrl call ran from atomic context. Reproduced on an
Amlogic A113X board with the workaround from commit 28f2406838
("pinctrl: meson: mark the GPIO controller as sleeping") reverted; the
original Khadas VIM3 report hit the same path:

	BUG: sleeping function called from invalid context
	  __mutex_lock
	  pinctrl_get_device_gpio_range
	  pinctrl_gpio_set_config
	  gpiochip_generic_config
	  gpiod_set_config
	  gpio_shared_proxy_set_config   <- voting spinlock held
	  ...
	  mmc_pwrseq_simple_probe

The spinlock existed to take the value vote from atomic context, but the
vote and the (possibly sleeping) control operations share the same state
and lock, so this scheme cannot serialize config under a mutex and still
offer atomic value access. Always serialize the shared descriptor with a
mutex instead and mark the proxy a sleeping gpiochip, driving the
underlying GPIO through the cansleep value accessors: those are valid
for both sleeping and non-sleeping chips, so value access keeps working
on fast controllers, at the cost of no longer being atomic.

With every vote edge now driven through the cansleep value setter,
gpio_shared_proxy_set_unlocked() no longer needs a per-call setter: drop
its set_func callback and call gpiod_set_value_cansleep() directly. The
shared direction_output path reaches it only once the line is already an
output, so driving the value there is equivalent to re-issuing
gpiod_direction_output(), without the redundant per-edge re-assertion of
drive config and bias.

This is observable: consumers gating on gpiod_cansleep() take their
sleeping branch on a proxied GPIO (mmc-pwrseq-emmc skips its
emergency-restart reset handler; its normal reset is unaffected), and
consumers that reject sleeping GPIOs (pwm-gpio, ps2-gpio, ...) would
fail to probe. Such atomic users do not share a pin through the proxy,
whose purpose is voting on shared reset/enable lines. The same narrowing
already applies on Amlogic since that workaround, and rockchip
addressed the identical splat per-driver in commit 7ca497be00 ("gpio:
rockchip: Stop calling pinctrl for set_direction"); fixing the proxy
addresses the locking error once, for every controller.

The lock type was added by commit a060b8c511 ("gpiolib: implement
low-level, shared GPIO support"); the sleeping call under it arrived with
the proxy driver.

Fixes: e992d54c6f ("gpio: shared-proxy: implement the shared GPIO proxy driver")
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Closes: https://lore.kernel.org/all/00107523-7737-4b92-a785-14ce4e93b8cb@samsung.com/
Signed-off-by: Viacheslav Bocharov <v@baodeep.com>
Link: https://patch.msgid.link/20260630101545.800625-2-v@baodeep.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-30 16:01:28 +02:00
Paul Louvel
9a6c0b6ea1 gpio-f7188x: Add support for NCT6126D version B
The Nuvoton NCT6126D Super-I/O is available in two hardware revisions.
According to the manufacturer datasheet revision 2.4, version A reports
chip ID 0xD283, while version B reports chip ID 0xD284.

The driver currently only recognizes only the version A ID. Version B
only contains hardware fixes unrelated to the GPIO functionality, so it
can be supported by simply adding its chip ID without any other driver
changes.

Fixes: 3002b8642f ("gpio-f7188x: fix chip name and pin count on Nuvoton chip")
Cc: stable@vger.kernel.org

Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Link: https://patch.msgid.link/20260629-gpio-f7188x-nct6126d-version-b-v1-1-a06226c02a2d@bootlin.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-30 09:48:39 +02:00
Pengpeng Hou
17326db5f0 gpio: htc-egpio: use managed gpiochip registration
egpio_probe() registers each nested gpio_chip with gpiochip_add_data()
but ignores the return value. If one registration fails, probe still
returns success even though one of the chips was not published to
gpiolib.

Use devm_gpiochip_add_data() and fail probe if any chip registration
fails. This lets devres unwind already registered chips and prevents
the driver from publishing a partially initialized device.

Fixes: a1635b8fe5 ("[ARM] 4947/1: htc-egpio, a driver for GPIO/IRQ expanders with fixed input/output pins")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260624131828.94139-1-pengpeng@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-26 11:58:20 +02:00
Pengpeng Hou
479e91fc92 gpio: mvebu: fail probe if gpiochip registration fails
mvebu_gpio_probe() registers the GPIO chip with
devm_gpiochip_add_data() but ignores the return value. If registration
fails, probe continues and leaves later code operating on a GPIO chip
that was never published to gpiolib.

Return the registration error so the device fails probe cleanly.

Fixes: fefe7b0923 ("gpio: introduce gpio-mvebu driver for Marvell SoCs")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260624131645.86884-1-pengpeng@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-26 11:50:46 +02:00
Qingshuang Fu
4e8eb6952a gpio: davinci: fix IRQ domain leak on devm_kzalloc failure
In davinci_gpio_irq_setup(), after successfully creating an IRQ domain
with irq_domain_create_legacy(), a subsequent devm_kzalloc() failure
in the bank loop causes the function to return -ENOMEM without
removing the IRQ domain.

Unlike devm-managed resources, irq_domain_create_legacy() does not
auto-clean up on probe failure, so the domain is leaked.

Fix by calling irq_domain_remove() before returning on allocation
failure.

Fixes: b5cf3fd827 ("gpio: davinci: Redesign driver to accommodate ngpios in one gpio chip")
Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Link: https://patch.msgid.link/20260623023106.117229-1-fffsqian@163.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-23 10:44:29 +02:00
Runyu Xiao
d3e91a95b2 gpio: tegra: do not call pinctrl for GPIO direction
tegra_gpio_direction_input() and tegra_gpio_direction_output() already
program the GPIO controller direction registers directly. The additional
pinctrl_gpio_direction_input/output() calls do not add a Tegra pinctrl
operation, because the Tegra pinmux ops provide GPIO request/free
handling but no gpio_set_direction hook.

The extra call still enters the pinctrl core and takes pctldev->mutex.
Shared GPIO users can call the direction path while holding their
per-line spinlock, so this otherwise redundant pinctrl direction call can
sleep in an atomic context.

This was found by our static analysis tool and then confirmed by manual
review of tegra_gpio_probe(), the Tegra GPIO direction callbacks and the
Tegra pinctrl ops. The reviewed path has a default non-sleeping
struct gpio_chip while the direction callback still enters the pinctrl
mutex path.

A directed runtime validation kept the same non-sleeping chip registration
and drove:

  gpio_shared_proxy_direction_output()
  gpiod_direction_output_raw_commit()
  tegra_gpio_direction_output()
  pinctrl_gpio_direction_output()

Lockdep reported a sleep-in-atomic warning with the shared GPIO spinlock
held and pinctrl_get_device_gpio_range() plus tegra_gpio_direction_output()
on the stack.

Do not mark the whole chip as can_sleep to paper over this: can_sleep
describes whether get()/set() may sleep, and Tegra value access is MMIO.
Remove the redundant pinctrl direction calls and keep pinctrl involvement
in the existing request/free path.

Fixes: 11da905412 ("gpio: tegra: Fix offset of pinctrl calls")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260619152439.1239561-1-runyu.xiao@seu.edu.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-23 10:44:12 +02:00
Igor Putko
9068c631d5 gpio: tb10x: fix struct tb10x_gpio kernel-doc
Fix build warning by adding the missing structure name and
description to the kernel-doc comment block.

Signed-off-by: Igor Putko <igorpetindev@gmail.com>
Link: https://patch.msgid.link/20260618155626.18751-2-igorpetindev@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-22 10:08:19 +02:00
Ruoyu Wang
99dfa46bab gpiolib: initialize return value in gpiochip_set_multiple()
gpiochip_set_multiple() falls back to setting lines one by one when the
chip does not provide set_multiple(). If the fallback path receives an
empty mask, the loop is skipped and ret is returned without being
initialized.

Initialize ret to 0 so an empty mask is treated as a successful no-op.

Fixes: 9b40731275 ("gpiolib: rework the wrapper around gpio_chip::set_multiple()")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260620155319.79994-1-ruoyuw560@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-22 10:07:11 +02:00
Bartosz Golaszewski
9611c0ce21 Merge commit '6beaec3aee9852438b89e4d7891caf5e84d45851' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-current
This pulls in the merge commit for MFD updates for v7.2. The PR contains
a build-time dependency of one of the GPIO commits that will follow.
2026-06-19 10:50:17 +02:00
Runyu Xiao
90f0109019 gpio: eic-sprd: use raw_spinlock_t in the irq startup path
sprd_eic_irq_unmask() enables the GPIO IRQ and then updates controller
state through sprd_eic_update(), which takes sprd_eic->lock with
spin_lock_irqsave().  The callback can be reached from irq_startup()
while setting up a requested IRQ.  That path is not sleepable, but on
PREEMPT_RT a regular spinlock_t becomes a sleeping lock.

This issue was found by our static analysis tool and then manually
reviewed against the current tree.

The grounded PoC kept the request_threaded_irq() -> __setup_irq() ->
irq_startup() -> sprd_eic_irq_unmask() -> sprd_eic_update() carrier and
used the original spin_lock_irqsave(&sprd_eic->lock) edge.  Lockdep
reported:

  BUG: sleeping function called from invalid context
  hardirqs last disabled at ... __setup_irq.constprop.0 ... [vuln_msv]
  sprd_rt_spin_lock_irqsave+0x1c/0x30 [vuln_msv]
  sprd_eic_update.constprop.0+0x48/0x90 [vuln_msv]
  sprd_eic_irq_unmask.constprop.0+0x35/0x50 [vuln_msv]
  __setup_irq.constprop.0+0xd/0x30 [vuln_msv]

Convert the Spreadtrum EIC controller lock to raw_spinlock_t.  The
locked section only serializes MMIO register updates and does not contain
sleepable operations, so keeping it non-sleeping is appropriate for the
irqchip callbacks.

Fixes: 25518e024e ("gpio: Add Spreadtrum EIC driver support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/20260617154035.1199948-3-runyu.xiao@seu.edu.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-18 10:02:13 +02:00
Runyu Xiao
286533cb14 gpio: sch: use raw_spinlock_t in the irq startup path
sch_irq_unmask() enables the GPIO IRQ and then updates the controller
state through sch_irq_mask_unmask(), which takes sch->lock with
spin_lock_irqsave().  The callback can be reached from irq_startup()
while setting up a requested IRQ.  That path is not sleepable, but on
PREEMPT_RT a regular spinlock_t becomes a sleeping lock.

This issue was found by our static analysis tool and then manually
reviewed against the current tree.

The grounded PoC kept the request_threaded_irq() -> __setup_irq() ->
irq_startup() -> sch_irq_unmask() -> sch_irq_mask_unmask() carrier and
used the original spin_lock_irqsave(&sch->lock) edge.  Lockdep reported:

  BUG: sleeping function called from invalid context
  hardirqs last disabled at ... __setup_irq.constprop.0 ... [vuln_msv]
  sch_rt_spin_lock_irqsave+0x1c/0x30 [vuln_msv]
  sch_irq_mask_unmask.constprop.0+0x31/0x70 [vuln_msv]
  __setup_irq.constprop.0+0xd/0x30 [vuln_msv]

Convert the SCH controller lock to raw_spinlock_t.  The same lock is
also used by the GPIO direction and value callbacks, but those critical
sections only update MMIO-backed GPIO registers and do not contain
sleepable operations.  Keeping this register lock non-sleeping is
therefore appropriate for the irqchip callbacks and does not change the
GPIO-side locking contract.

Fixes: 7a81638485 ("gpio: sch: Add edge event support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Link: https://patch.msgid.link/20260617154035.1199948-2-runyu.xiao@seu.edu.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-18 10:02:13 +02:00
Linus Torvalds
b85966adbf Networking changes for 7.2.
Core & protocols
 ----------------
 
  - Work on removing rtnl_lock protection throughout the stack continues.
    In this chapter:
     - don't use rtnl_lock for IPv6 multicast routing configuration
     - don't take rtnl_lock in ethtool for modern drivers
     - prepare Qdisc dump callbacks for rtnl_lock removal
 
  - Support dumping just ifindex + name of all interfaces, under RCU.
    It's a common operation for Netlink CLI tools (when translating
    names to ifindexes) and previously required full rtnl_lock.
 
  - Support dumping qdiscs and page pools for a specific netdev. Even tho
    user space wants a dump of all netdevs, most of the time, the OOO
    programming model results in repeating the dump for each netdev.
    Which, in absence of a cache, leads to a O(n^2) behavior.
 
  - Flush nexthops once on multi-nexthop removal (e.g. when device goes
    down), another O(n^2) -> O(n) improvement.
 
  - Rehash locally generated traffic to a different nexthop on retransmit
    timeout.
 
  - Honor oif when choosing nexthop for locally generated IPv6 traffic.
 
  - Convert TCP Auth Option to crypto library, and drop non-RFC algos.
 
  - Increase subflow limits in MPTCP to 64 and endpoint limit to 256.
 
  - Support MPTCP signaling of IPv6 address + port (ADD_ADDR). We need
    to selectively skip reporting of the standard TCP Timestamp option,
    because they won't fit into the header space together (12 + 30 > 40).
 
  - Support using bridge neighbor suppression, Duplicate Address
    Detection, Gratuitous ARP and unsolicited NA forwarding - in EVPN
    deployments, e.g. VXLAN fabrics (IPv4 and IPv6).
 
  - Improve link state reporting for upper netdevs (e.g. macvlan) over
    tunnel devices (again, mostly for EVPN deployments).
 
  - Support binding GENEVE tunnels to a local address.
 
  - Speed up UDP tunnel destruction (remove one synchronize_rcu()).
 
  - Support exponential field encoding in multicast (IGMPv3 and MLDv2).
 
  - Support attaching PSP crypto offload to containers (veth, netkit).
 
  - Add a new IPSec Netlink message XFRM_MSG_MIGRATE_STATE that allows
    migrating individual IPsec SAs independently of their policies.
    The existing XFRM_MSG_MIGRATE is tightly coupled to policy+SA
    migration, lacks SPI for unique SA identification, and cannot express
    reqid changes or migrate Transport mode selectors. The new interface
    identifies the SA via SPI and mark, supports reqid changes, address
    family changes, encap removal, and uses an atomic create+install
    flow under x->lock to prevent SN/IV reuse during AEAD SA migration.
 
  - Implement GRO/GSO support for PPPoE.
 
  - Convert sockopt callbacks in a number of protocols to iov_iter.
 
 Cross-tree stuff
 ----------------
 
  - Remove support for Crypto TFM cloning (unblocked after the TCP Auth
    Option rework). This feature regressed performance for all crypto API
    users, since it changed crypto transformation objects into reference-
    -counted objects.
 
  - Add FCrypt-PCBC implementation to rxrpc and remove it from the global
    crypto API as obsolete and insecure.
 
 Wireless
 --------
 
  - Major rework of station bandwidth handling, fixing issues with lower
    capability than AP.
 
  - Cleanups for EMLSR spec issues (drafts differed).
 
  - More Neighbor Awareness Networking (Wi-Fi Aware) work (multicast,
    schedule improvements, multi-station etc.)
 
  - Some Ultra High Reliability (UHR) / IEEE 802.11bn (D1.4) work
    (e.g. non-primary channel access, UHR DBE support).
 
  - Fine Timing Measurement ranging (i.e. distance measurement) APIs.
 
 Netfilter
 ---------
 
  - Use per-rule hash initval in nf_conncount. This avoids unnecessary
    lock contention with short keys (e.g. conntrack zones) in different
    namespaces.
 
  - Various safety improvements, both in packet parsing and object
    lifetimes. Notably add refcounts to conntrack timeout policy.
 
 Deletions
 ---------
 
  - Remove TLS + sockmap integration. TLS wants to pin user pages
    to avoid a copy, and sockmap wants to write to the input stream.
    More work on this integration is clearly needed, and we can't find
    any users (original author admitted that they never deployed it).
 
  - Remove support for TLS offload with TCP Offload Engine (the far
    more common opportunistic offload is retained). The locking looks
    unfixable (driver sleeps under TCP spin locks) and people from
    the vendor that added this are AWOL.
 
  - Remove more ATM code, trying to leave behind only what PPPoATM needs,
    AAL5 and br2684 with permanent circuits.
 
  - Remove AppleTalk. Let it join hamradio in our out of tree protocol
    graveyard, I mean, repository.
 
  - Disable 32-bit x_tables compatibility (32bit binaries on 64bit kernel)
    interface in user namespaces. To be deleted completely, soon.
 
  - Remove 5/10 MHz support from cfg80211/mac80211.
 
 Drivers
 -------
 
  - Software:
    - Support DEVMEM/DMABUF Tx over NETMEM_TX_NO_DMA devices (netkit).
    - bonding: add knob to strictly follow 802.3ad for link state.
 
  - New drivers:
    - Alibaba Elastic Ethernet Adaptor (cloud vNIC).
    - NXP NETC switch within i.MX94.
 
  - DPLL:
    - Add operational state to pins (implement in zl3073x).
    - Add generic DPLL type, for daisy-chaining DPLLs (implement in ice).
 
  - Ethernet high-speed NICs:
    - Huawei (hinic3):
      - enhance tc flow offload support with queue selection, tunnels
    - nVidia/Mellanox:
      - avoid over-copying payload to the skb's linear part (up to 60%
        win for LRO on slow CPUs like ARM64 V2)
      - expose more per-queue stats over the standard API
      - support additional, unprivileged PFs in the DPU configuration
      - support Socket Direct (multi-PF) with switchdev offloads
      - add a pool / frag allocator for DMA mapped buffers for control
        objects, save memory on systems with 64kB page size
      - take advantage of the ability to dynamically change RSS table
        size, even when table is configured by the user
      - increase the max RSS table size for even traffic distribution
 
  - Ethernet NICs:
    - Marvell/Aquantia:
      - AQC113 PTP support
    - Realtek USB (r8152):
      - support 10Gbit Link Speeds and Energy-Efficient Ethernet (EEE)
      - support firmware loaded (for RTL8157/RTL8159)
      - support for the RTL8159
    - Intel (ixgbe):
      - support Energy-Efficient Ethernet (EEE) on E610 devices
 
  - Ethernet switches:
    - Airoha:
      - support multiple netdevs on a single GDM block / port
    - Marvell (mv88e6xxx):
      - support SERDES of mv88e6321
    - Microchip (ksz8/9):
      - rework the driver callbacks to remove one indirection layer
    - Motorcomm (yt921x):
      - support port rate policing
      - support TBF qdisc offload
      - support ACL/flower offload
    - nVidia/Mellanox:
      - expose per-PG rx_discards
    - Realtek:
      - rtl8365mb: bridge offloading and VLAN support
 
  - Ethernet PHYs:
    - Airoha:
      - support Airoha AN8801R Gigabit PHYs.
    - Micrel:
      - implement 3 low-loss cable tunables
    - Realtek:
      - support MDI swapping for RTL8226-CG
      - support MDIO for RTL931x
    - Qualcomm:
      - at803x: Rx and Tx clock management for IPQ5018 PHY
    - Motorcomm:
      - support YT8522 100M RMII PHY
      - set drive strength in YT8531s RGMII
    - TI:
      - dp83822: add optional external PHY clock
 
  - Bluetooth:
    - hci_sync: add support for HCI_LE_Set_Host_Feature [v2]
    - SMP: use AES-CMAC library API
    - Intel:
      - support Product level reset
      - support smart trigger dump
    - Mediatek:
      - add event filter to filter specific event
    - Realtek:
      - fix RTL8761B/BU broken LE extended scan
 
  - WiFi:
    - Broadcom (b43):
      - new support for a 11n device
    - MediaTek (mt76):
      - support mt7927
      - mt792x: broken usb transport detection
      - mt7921: regulatory improvements
    - Qualcomm (ath9k):
      - GPIO interface improvements
    - Qualcomm (ath12k):
      - WDS support
      - replace dynamic memory allocation in WMI Rx path
      - thermal throttling/cooling device support
      - 6 GHz incumbent interference detection
      - channel 177 in 5 GHz
    - Realtek (rt89):
      - RTL8922AU support
      - USB 3 mode switch for performance
      - better monitor radiotap support
      - RTL8922DE preparations
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmox1O4ACgkQMUZtbf5S
 Irve7hAAgvCYRFvQ/1dvL+PORg2KqVW4rWXMvNrEWaMVAEXJIIPJoxen6zn6a/72
 aRs2Ord/wVM/Uh291TOrARwtv1U0oOvOvnbrVM2u06o/EqjtxRAZSF9quTlPdm6Q
 RvlkR5X9XXM2MwbDc1zYNTITfhVv80YDCFmYGI7O8dyhLuyspX2eU0SiW33Twl4f
 y6RLcn12gyUbDpa6vt+tari6cFCO/X2zot/uwaDY38b+kwsMHunrj3/PSfJzeYIU
 5mD7jG+xsPxQlEskMYGOjVT5VeMdRquhb9UGwoostZpuEPYZfzTdFtphC1qZqIPk
 8O8ngAW1yYNIY9TTMPF3Y3LMpOiyZq6/P4KY+tksbeDw8vvTYJzEgw3VpwurZQLM
 vfHKDj1kM6VLNekeCI+2cip06flVH3jtIkN0KOERwzTSS8NUbs6PuoEP0HLdjafj
 cr/pgSSTQPUsQkpS5R5Ld3bwpnKea56CQ36p2E8JvU2akwK5RnvqiZiTAfz2z2Tg
 M0NVlTsJ07ucNBxsO4l7osDtRTnzUqo+ZeTo+zR5l0cGRXPd9nJByk257z4IAlcQ
 2MHrJmCZ+ZFKhmkUNUPBdFBATbRgOZHzA/iiiThBrT2hDvWQ2kygO9+IkJBS/WYx
 eQz7G9hb6Xn1ifWVvPVD0oDL3DKKTotQIN90PZCzvObQFWMc1Vk=
 =oNfE
 -----END PGP SIGNATURE-----

Merge tag 'net-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

Pull networking updates from Jakub Kicinski:
 "Core & protocols:

   - Work on removing rtnl_lock protection throughout the stack
     continues. In this chapter:
       - don't use rtnl_lock for IPv6 multicast routing configuration
       - don't take rtnl_lock in ethtool for modern drivers
       - prepare Qdisc dump callbacks for rtnl_lock removal

   - Support dumping just ifindex + name of all interfaces, under RCU.
     It's a common operation for Netlink CLI tools (when translating
     names to ifindexes) and previously required full rtnl_lock.

   - Support dumping qdiscs and page pools for a specific netdev. Even
     tho user space wants a dump of all netdevs, most of the time, the
     OOO programming model results in repeating the dump for each
     netdev. Which, in absence of a cache, leads to a O(n^2) behavior.

   - Flush nexthops once on multi-nexthop removal (e.g. when device goes
     down), another O(n^2) -> O(n) improvement.

   - Rehash locally generated traffic to a different nexthop on
     retransmit timeout.

   - Honor oif when choosing nexthop for locally generated IPv6 traffic.

   - Convert TCP Auth Option to crypto library, and drop non-RFC algos.

   - Increase subflow limits in MPTCP to 64 and endpoint limit to 256.

   - Support MPTCP signaling of IPv6 address + port (ADD_ADDR). We need
     to selectively skip reporting of the standard TCP Timestamp option,
     because they won't fit into the header space together (12 + 30 >
     40).

   - Support using bridge neighbor suppression, Duplicate Address
     Detection, Gratuitous ARP and unsolicited NA forwarding - in EVPN
     deployments, e.g. VXLAN fabrics (IPv4 and IPv6).

   - Improve link state reporting for upper netdevs (e.g. macvlan) over
     tunnel devices (again, mostly for EVPN deployments).

   - Support binding GENEVE tunnels to a local address.

   - Speed up UDP tunnel destruction (remove one synchronize_rcu()).

   - Support exponential field encoding in multicast (IGMPv3 and MLDv2).

   - Support attaching PSP crypto offload to containers (veth, netkit).

   - Add a new IPSec Netlink message XFRM_MSG_MIGRATE_STATE that allows
     migrating individual IPsec SAs independently of their policies.

     The existing XFRM_MSG_MIGRATE is tightly coupled to policy+SA
     migration, lacks SPI for unique SA identification, and cannot
     express reqid changes or migrate Transport mode selectors.

     The new interface identifies the SA via SPI and mark, supports
     reqid changes, address family changes, encap removal, and uses an
     atomic create+install flow under x->lock to prevent SN/IV reuse
     during AEAD SA migration.

   - Implement GRO/GSO support for PPPoE.

   - Convert sockopt callbacks in a number of protocols to iov_iter.

  Cross-tree stuff:

   - Remove support for Crypto TFM cloning (unblocked after the TCP Auth
     Option rework). This feature regressed performance for all crypto
     API users, since it changed crypto transformation objects into
     reference-counted objects.

   - Add FCrypt-PCBC implementation to rxrpc and remove it from the
     global crypto API as obsolete and insecure.

  Wireless:

   - Major rework of station bandwidth handling, fixing issues with
     lower capability than AP.

   - Cleanups for EMLSR spec issues (drafts differed).

   - More Neighbor Awareness Networking (Wi-Fi Aware) work (multicast,
     schedule improvements, multi-station etc.)

   - Some Ultra High Reliability (UHR) / IEEE 802.11bn (D1.4) work
     (e.g. non-primary channel access, UHR DBE support).

   - Fine Timing Measurement ranging (i.e. distance measurement) APIs.

  Netfilter:

   - Use per-rule hash initval in nf_conncount. This avoids unnecessary
     lock contention with short keys (e.g. conntrack zones) in different
     namespaces.

   - Various safety improvements, both in packet parsing and object
     lifetimes. Notably add refcounts to conntrack timeout policy.

  Deletions:

   - Remove TLS + sockmap integration. TLS wants to pin user pages to
     avoid a copy, and sockmap wants to write to the input stream. More
     work on this integration is clearly needed, and we can't find any
     users (original author admitted that they never deployed it).

   - Remove support for TLS offload with TCP Offload Engine (the far
     more common opportunistic offload is retained). The locking looks
     unfixable (driver sleeps under TCP spin locks) and people from the
     vendor that added this are AWOL.

   - Remove more ATM code, trying to leave behind only what PPPoATM
     needs, AAL5 and br2684 with permanent circuits.

   - Remove AppleTalk. Let it join hamradio in our out of tree protocol
     graveyard, I mean, repository.

   - Disable 32-bit x_tables compatibility (32bit binaries on 64bit
     kernel) interface in user namespaces. To be deleted completely,
     soon.

   - Remove 5/10 MHz support from cfg80211/mac80211.

  Drivers:

   - Software:
       - Support DEVMEM/DMABUF Tx over NETMEM_TX_NO_DMA devices (netkit)
       - bonding: add knob to strictly follow 802.3ad for link state

   - New drivers:
       - Alibaba Elastic Ethernet Adaptor (cloud vNIC).
       - NXP NETC switch within i.MX94.

   - DPLL:
       - Add operational state to pins (implement in zl3073x).
       - Add generic DPLL type, for daisy-chaining DPLLs (implement in ice).

   - Ethernet high-speed NICs:
       - Huawei (hinic3):
           - enhance tc flow offload support with queue selection,
             tunnels
       - nVidia/Mellanox:
           - avoid over-copying payload to the skb's linear part (up to
             60% win for LRO on slow CPUs like ARM64 V2)
           - expose more per-queue stats over the standard API
           - support additional, unprivileged PFs in the DPU
             configuration
           - support Socket Direct (multi-PF) with switchdev offloads
           - add a pool / frag allocator for DMA mapped buffers for
             control objects, save memory on systems with 64kB page size
           - take advantage of the ability to dynamically change RSS
             table size, even when table is configured by the user
           - increase the max RSS table size for even traffic
             distribution

   - Ethernet NICs:
       - Marvell/Aquantia:
           - AQC113 PTP support
       - Realtek USB (r8152):
           - support 10Gbit Link Speeds and Energy-Efficient Ethernet
             (EEE)
           - support firmware loaded (for RTL8157/RTL8159)
           - support for the RTL8159
       - Intel (ixgbe):
           - support Energy-Efficient Ethernet (EEE) on E610 devices

   - Ethernet switches:
       - Airoha:
           - support multiple netdevs on a single GDM block / port
       - Marvell (mv88e6xxx):
           - support SERDES of mv88e6321
       - Microchip (ksz8/9):
           - rework the driver callbacks to remove one indirection layer
       - Motorcomm (yt921x):
           - support port rate policing
           - support TBF qdisc offload
           - support ACL/flower offload
       - nVidia/Mellanox:
           - expose per-PG rx_discards
       - Realtek:
           - rtl8365mb: bridge offloading and VLAN support

   - Ethernet PHYs:
       - Airoha:
           - support Airoha AN8801R Gigabit PHYs.
       - Micrel:
           - implement 3 low-loss cable tunables
       - Realtek:
           - support MDI swapping for RTL8226-CG
           - support MDIO for RTL931x
       - Qualcomm:
           - at803x: Rx and Tx clock management for IPQ5018 PHY
       - Motorcomm:
           - support YT8522 100M RMII PHY
           - set drive strength in YT8531s RGMII
       - TI:
           - dp83822: add optional external PHY clock

   - Bluetooth:
       - hci_sync: add support for HCI_LE_Set_Host_Feature [v2]
       - SMP: use AES-CMAC library API
       - Intel:
           - support Product level reset
           - support smart trigger dump
       - Mediatek:
           - add event filter to filter specific event
       - Realtek:
           - fix RTL8761B/BU broken LE extended scan

   - WiFi:
       - Broadcom (b43):
           - new support for a 11n device
       - MediaTek (mt76):
           - support mt7927
           - mt792x: broken usb transport detection
           - mt7921: regulatory improvements
       - Qualcomm (ath9k):
           - GPIO interface improvements
       - Qualcomm (ath12k):
           - WDS support
           - replace dynamic memory allocation in WMI Rx path
           - thermal throttling/cooling device support
           - 6 GHz incumbent interference detection
           - channel 177 in 5 GHz
       - Realtek (rt89):
           - RTL8922AU support
           - USB 3 mode switch for performance
           - better monitor radiotap support
           - RTL8922DE preparations"

* tag 'net-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1778 commits)
  ipv4: fib_rule: Move fib4_rules_exit() to ->exit().
  net: serialize netif_running() check in enqueue_to_backlog()
  net: skmsg: preserve sg.copy across SG transforms
  appletalk: move the protocol out of tree
  appletalk: stop storing per-interface state in struct net_device
  selftests/bpf: test that TLS crypto is rejected on a sockmap socket
  selftests/bpf: drop the unused kTLS program from test_sockmap
  selftests/bpf: remove sockmap + ktls tests
  tls: remove dead sockmap (psock) handling from the SW path
  tls: reject the combination of TLS and sockmap
  atm: remove orphaned uAPI for deleted drivers, protocols and SVCs
  atm: remove unused ATM PHY operations
  atm: remove the unused pre_send and send_bh device operations
  atm: remove the unused change_qos device operation
  atm: remove SVC socket support and the signaling daemon interface
  atm: remove the local ATM (NSAP) address registry
  atm: remove dead SONET PHY ioctls
  atm: remove the unused send_oam / push_oam callbacks
  atm: remove AAL3/4 transport support
  net: dsa: sja1105: fix lastused timestamp in flower stats
  ...
2026-06-17 08:17:00 +01:00
Marco Scardovi
ae9f812df3 gpiolib: acpi: Prevent out-of-bounds pin access in OperationRegion handler
The ACPI GPIO OperationRegion handler receives pin offsets as a
64-bit address. Previously, this value could be assigned to a pin index
without validation, potentially causing out-of-bounds access if
the ACPI table provides an invalid offset.

This patch explicitly checks that the 64-bit address is less than
agpio->pin_table_length before using it, returning AE_BAD_PARAMETER
if the check fails. Additionally, it makes the length calculation
overflow-safe and ensures proper unsigned types for loop counters.

This corrects the commit message from v5 to accurately reflect the
underlying issue, removing references to truncation or wrap-around,
which do not occur in ACPICA.

Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Marco Scardovi <scardracs@disroot.org>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Link: https://patch.msgid.link/20260610154204.110379-3-scardracs@disroot.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-17 08:14:30 +02:00
Marco Scardovi
dece79032f gpiolib: acpi: Add robust bounds-checking for GPIO pin resources
Ensure that GPIO pin resource arrays are safely bounded before accessing
indices. Add explicit bounds checking in acpi_request_own_gpiod(),
acpi_gpio_irq_is_wake(), and acpi_gpiochip_alloc_event() to prevent
out-of-bounds array reads if the ACPI namespace provides malformed or empty
pin tables.

This change addresses potential safety issues arising from
inconsistent or invalid ACPI pin tables. It does not alter functional
behavior in well-formed tables.

Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Marco Scardovi <scardracs@disroot.org>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Link: https://patch.msgid.link/20260610154204.110379-2-scardracs@disroot.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-17 08:14:30 +02:00
Bartosz Golaszewski
86c04b2960 intel-gpio for v7.1-1
* Only trigger interrupts that defined ActiveBoth in ACPI on boot
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEqaflIX74DDDzMJJtb7wzTHR8rCgFAmn8g2EACgkQb7wzTHR8
 rCjtNw//TswGFHB2QezfVbiV6oY3qX7I/XdyDR1OMNDYmd4WcAAQmVnKSosKfWe9
 fhntKSaAwoghxHUmmDpTothS11pf6qbif7/I311Z/UU31ue4rDPKmGAqY5kXBufl
 qPGQqdVdt2zz/ClyCmRuNuUuFn0pruofcwmPCOkpZi2EMqPown6E68LK7jNiLYsh
 Z5lRm10QNKApeBQ6MH6TYXbmKPDOI80JvBX1WjXarNhZtkhtqu2KJ/ItKhXcUU/N
 rzous/6pnrL9y4iT6/ZPScdwrFtFbb8WxqxT3PFTtimQH1FNTm8F5nHTw0N9VswL
 TMalKrzNLHmNODxvCGDW9gWl9VRdur7ZEbGDqbMjZRXUVI87pr3x5e4hc6XuUJhV
 SbrVX7etnhq5+iUcpo6vqncEvDxgglb5eY4X/imrVTwwsIW3V1ZpijS0VBAUBNZ8
 Q8yH/xAXtPZEXxLvPRhMEGNe3lhuZm8qX51xdopIz5+qtUjYnnUAPc9oi9CiQ26z
 8k0WNQjj69w5FX0HJAkfzecixd5Aaby4IRx7wWzKAlcjKHTd9Q6d2aC79+mOiPyc
 YO/Gw5i2b2INRh7XeAaE1u0eXSgT4kfD4YmiehNQV6htQh+rUQRi1xXFHvdv6vuU
 eoviDdzXhV6VGp+ZRJMtkcOGkHPQK6MvwTpns8O284TZBO6Hb74=
 =jCBH
 -----END PGP SIGNATURE-----

Merge tag 'intel-gpio-v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel into gpio/for-current

intel-gpio for v7.1-1

* Only trigger interrupts that defined ActiveBoth in ACPI on boot
2026-06-16 11:52:52 +02:00
Pengpeng Hou
0482862a90 gpio: mlxbf3: fail probe if gpiochip registration fails
mlxbf3_gpio_probe() logs a devm_gpiochip_add_data() failure but still
returns success. That leaves the platform device bound even though the
GPIO chip was not registered.

Return the registration error so probe failure matches the missing
gpiochip state.

Fixes: cd33f216d2 ("gpio: mlxbf3: Add gpio driver support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260615091918.43333-1-pengpeng@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-16 09:42:17 +02:00
Rob Herring (Arm)
4910aa198d gpio: pisosr: Read "ngpios" as u32
The generic "ngpios" property is encoded as a normal uint32 cell. The
pisosr driver stores it in the gpio_chip field, but reading it with a
u16 helper does not match the DT property encoding.

Read "ngpios" as u32 and keep the existing assignment to the chip
field.

Assisted-by: Codex:gpt-5-5
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260612215216.1887485-1-robh@kernel.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-16 09:19:32 +02:00
Linus Torvalds
fc2ce3ee10 hwmon updates for v7.2
* New drivers for the following chips
 
 - Analog Devices LTC4283 Swap Controller
 
 - Analog Devices MAX20830
 
 - Analog Devices MAX20860A
 
 - ARCTIC Fan Controller
 
 - Delta E50SN12051
 
 - Luxshare LX1308
 
 - Microchip EMC1812/13/14/15/33
 
 - Monolithic MP2985
 
 - Murata D1U74T PSU
 
 * New chip support added to existing drivers
 
 - asus-ec-sensors: Support for ROG MAXIMUS Z790 EXTREME, ROG STRIX B850-E
   GAMING WIFI, and ROG STRIX B650E-E GAMING WIFI
 
 - dell-smm: Add Dell Latitude 7530 to fan control whitelist
 
 - nct6683: Support for ASRock Z890 Pro-A
 
 - pmbus: Support for Flex BMR316, BMR321, BMR350 and BMR351
 
 - pmbus/max34440: Support for ADPM12250
 
 - pmbus/xdp720: Support for Infineon xdp730, and fix driver issues
   reported by Sashiko
 
 * New functionality
 
 - Add support for update_interval_us chip attribute, and support it
   in ina238 driver
 
 - Add support for guard() and scoped_guard() for subsystem locks,
   and use it in adt7411, ina2xx, and lm90 drivers
 
 - emc2305: Support configurable fan PWM at shutdown
 
 - lm63: Expose PWM frequency and LUT hysteresis as writable
 
 - lm75: Support active-high alert polarity
 
 - nct7802: Add time step attributes for tweaking responsiveness
 
 - pmbus/adm1266: Add rtc debugfs entries for rtc, powerup_counter,
   clear_blackbox, and firmware_revision
 
 - raspberrypi: Fix delayed-work teardown race, add voltage input support
   as well as voltage domain IDs
 
 mcp9982: Add support for reporting external diode faults
 
 * Miscellaneous bug fixes, changes and improvements
 
 - Use named initializers for platform_device_id arrays and
   i2c_device_data, and remove unused driver data
 
 - Various drivers: Move MODULE_DEVICE_TABLE next to the table itself
 
 - ads7871: Convert to hwmon_device_register_with_info(), and use
   DMA-safe buffer for SPI writes
 
 - adt7411: document supported sysfs attributes
 
 - adt7462: Add of_match_table to support devicetree
 
 - adt7475: Add explicit header include
 
 - coretemp; Fix outdated documentation, coding style issues, and
   replace hardcoded core count with dynamic value
 
 - cros_ec: Drop unused assignment of platform_device_id driver data
 
 - emc2305: Fix fan channel index handling
 
 - gpd-fan: Reject EC PWM value 0 as invalid, fix race condition between
   device removal and sysfs access, upgrade log level from warn to err for
   platform device creation failure, initialize EC before registering hwmon
   device, drop global driver data and use per-device allocation
 
 - htu31: document debugfs serial_number
 
 - ina238: Add support for samples and update_interval
 
 - it87: Clamp negative values to zero in set_fan()
 
 - lm75: Add explicit header include, Add explicit default cases in
   lm75_is_visible(), and add section for sysfs interface to documentation
 
 - pmbus/lm25066: Fix PMBus coefficients for LM5064/5066/5066i
 
 - tmp102: Use device_property_read_string API
 
 - tmp401: Read "ti,n-factor" as signed
 
 - Convert zyxel,nsa320-mcu to DT schema
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmowFrQACgkQyx8mb86f
 mYHgww/7B620RT1wqLdMizetj/nvYx83LFfBWQTljwCJaOHpX+1Ym1gTQpItNuec
 k0OdgkhoEzlemvo4CCNl6rKwH8WYyGcDrXkS8mPDKcbaDPT9c9SSXkzbsTSeNOFc
 N+PVjy1GA3h3uVxS9eG1+BVXpY4MGnDwN1zfGBZY0XjEzxzw9YIee3qQ6AncHAjn
 6x0n3H3p0B3uZaazyC+6Po1OH3BbvI1mgVAbhYlkf8Z9QAzLggEZWCmM7WtsqQip
 Jd9wsCGq3t6q+tKWOt955DxNEMj97QEHo4LhVQ5Ezr5wQ7GTHv9k8Ygswb+wVYNB
 OUK8pCVZJ2E6IFF6m2O2jJyzscijGGT9cifnJkopvk01Z1kTGggs8W2gQwlhE10T
 ir3gT6fAUoVy/R+t2Tqj633UiBNW3OofzwwhJ9W5m2Kej64W9KFp+2R1VageaPU2
 7J96Kdc8OUipaTf11XoqUR1JtiIvOg/UMEMgGwR3ihMjW6/tEq0hBWIGiNlY50ZK
 NdricCRKN3ujWvNSQRFoQl32UWuGONhE1P0bAvitmrMKyitYsEQMMFXm7ja5xqZO
 OogVAEaakzjqtMFk7MbZpBkYHYndtaDMu2L0HytlFifCvUqiqCqjmHBKzxk6zHPs
 +j6VP62fQ5iVffu6lpn0N505vtbon19JEP8JKB5JSJDgcAHUBJA=
 =mDMd
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon updates from Guenter Roeck:
 "New drivers for the following chips:
   - Analog Devices LTC4283 Swap Controller
   - Analog Devices MAX20830
   - Analog Devices MAX20860A
   - ARCTIC Fan Controller
   - Delta E50SN12051
   - Luxshare LX1308
   - Microchip EMC1812/13/14/15/33
   - Monolithic MP2985
   - Murata D1U74T PSU

  New chip support added to existing drivers:
   - asus-ec-sensors: Support for ROG MAXIMUS Z790 EXTREME, ROG STRIX
     B850-E GAMING WIFI, and ROG STRIX B650E-E GAMING WIFI
   - dell-smm: Add Dell Latitude 7530 to fan control whitelist
   - nct6683: Support for ASRock Z890 Pro-A
   - pmbus: Support for Flex BMR316, BMR321, BMR350 and BMR351
   - pmbus/max34440: Support for ADPM12250
   - pmbus/xdp720: Support for Infineon xdp730, and fix driver issues
     reported by Sashiko

  New functionality:
   - Add support for update_interval_us chip attribute, and support it
     in ina238 driver
   - Add support for guard() and scoped_guard() for subsystem locks, and
     use it in adt7411, ina2xx, and lm90 drivers
   - emc2305: Support configurable fan PWM at shutdown
   - lm63: Expose PWM frequency and LUT hysteresis as writable
   - lm75: Support active-high alert polarity
   - nct7802: Add time step attributes for tweaking responsiveness
   - pmbus/adm1266: Add rtc debugfs entries for rtc, powerup_counter,
     clear_blackbox, and firmware_revision
   - raspberrypi: Fix delayed-work teardown race, add voltage input
     support as well as voltage domain IDs
   - mcp9982: Add support for reporting external diode faults

  Miscellaneous bug fixes, changes and improvements:
   - Use named initializers for platform_device_id arrays and
     i2c_device_data, and remove unused driver data
   - Various drivers: Move MODULE_DEVICE_TABLE next to the table itself
   - ads7871: Convert to hwmon_device_register_with_info(), and use
     DMA-safe buffer for SPI writes
   - adt7411: document supported sysfs attributes
   - adt7462: Add of_match_table to support devicetree
   - adt7475: Add explicit header include
   - coretemp; Fix outdated documentation, coding style issues, and
     replace hardcoded core count with dynamic value
   - cros_ec: Drop unused assignment of platform_device_id driver data
   - emc2305: Fix fan channel index handling
   - gpd-fan: Reject EC PWM value 0 as invalid, fix race condition
     between device removal and sysfs access, upgrade log level from
     warn to err for platform device creation failure, initialize EC
     before registering hwmon device, drop global driver data and use
     per-device allocation
   - htu31: document debugfs serial_number
   - ina238: Add support for samples and update_interval
   - it87: Clamp negative values to zero in set_fan()
   - lm75: Add explicit header include, Add explicit default cases in
     lm75_is_visible(), and add section for sysfs interface to
     documentation
   - pmbus/lm25066: Fix PMBus coefficients for LM5064/5066/5066i
   - tmp102: Use device_property_read_string API
   - tmp401: Read "ti,n-factor" as signed
   - Convert zyxel,nsa320-mcu to DT schema"

* tag 'hwmon-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (81 commits)
  hwmon: tmp401: Read "ti,n-factor" as signed
  hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
  hwmon: (gpd-fan) Reject EC PWM value 0 as invalid
  hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist
  hwmon: temperature: add support for EMC1812
  dt-bindings: hwmon: temperature: add support for EMC1812
  hwmon: (gpd-fan): fix race condition between device removal and sysfs access
  hwmon: (gpd-fan): upgrade log level from warn to err for platform device creation failure
  hwmon: (gpd-fan): Initialize EC before registering hwmon device
  hwmon: (gpd-fan): drop global driver data and use per-device allocation
  hwmon: (pmbus/max34440): add support adpm12250
  hwmon: (ina238) Add update_interval_us attribute
  hwmon: Add update_interval_us chip attribute
  hwmon: (ina238) Add support for samples and update_interval
  gpio: gpio-ltc4283: Add support for the LTC4283 Swap Controller
  hwmon: ltc4283: Add support for the LTC4283 Swap Controller
  dt-bindings: hwmon: Document the LTC4283 Swap Controller
  hwmon: (pmbus/xdp720) Fix driver issues xdp720/730
  hwmon: (pmbus/xdp720) Add support for efuse xdp730
  dt-bindings: hwmon/pmbus: Add Infineon xdp730
  ...
2026-06-16 08:10:21 +05:30
Linus Torvalds
77d084d66b gpio updates for v7.2-rc1
GPIO core:
 - Add an initial set of kunit test cases for the GPIO subsystem
 - Use the devres owner as the GPIO chip's parent in absence of any other
   parent
 - Fix const-correctness of GPIO chip SRCU guards
 - Provide new GPIO consumer interfaces: gpiod_is_single_ended() and
   fwnode_gpiod_get()
 - Quarantine all legacy GPIO APIs in linux/gpio/legacy.h
 - Use __ro_after_init where applicable
 
 New drivers:
 - Add driver for the GPIO controller on Waveshare DSI TOUCH panels
 
 Removed drivers:
 - Remove the obsolete ts5500 GPIO driver
 
 Driver updates:
 - Modernize gpio-timberdale: remove platform data support and use generic
   device property accessors
 - Extend test build coverage by enabling COMPILE_TEST for more GPIO
   drivers
 - Add some missing dependencies in Kconfig
 - Add support for sparse fixed direction to gpio-regmap
 - Remove dead code from gpio-nomadik
 - use BIT() in gpio-mxc
 - use bitmap_complement() in gpio-xilinx and gpio-pca953x
 - Use more appropriate printing functions where applicable
 - Use named initializers for platform_device_id and i2c_device_id arrays
 - Convert gpio-altera to using the generic GPIO chip helper library
 - Add support for new models to gpio-dwapb, gpio-zynq, gpio-usbio and
   gpio-tegra186
 - Unify the naming convention for Qualcomm in GPIO drivers
 - Fix interrupt bank mapping to GPIO chips in gpio-mt7621
 - Add support for the lines-initial-states property to gpio-74x164
 - Switch to using dynamic GPIO base in gpio-ixp4xx
 - Move the handling of an OF quirk from ASoC to gpiolib-of.c where other
   such quirks live
 - Use handle_bad_irq() in gpio-ep93xx
 - Some other minor tweaks and refactorings
 
 Devicetree bindings:
 - Document the Waveshare GPIO controller for DSI TOUCH panels
 - Document new models: Tegra238 in gpio-tegra186 and EIO GPIO in gpio-zynq
 - Add new properties for gpio-dwapb and fairchild,74hc595
 - Fix whitespace issues
 - Sort compatibles alphabetically in gpio-zynq
 
 Documentation:
 - Fix kerneldoc warnings in gpio-realtek-otto
 
 Misc:
 - Attach software nodes representing GPIO chips to the actual struct
   device objects associated with them in some legacy platforms enabling
   real firmware node lookup instead of string matching
 - Drop unneeded dependencies on OF_GPIO from bus and staging drivers
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmovs6IACgkQBZ0uy/82
 hMNGIRAAj5dQALT1UfZ7jYRXR035CvQU1Sdn3O+0Y+r10eBdRaT573iI9IRDmoiu
 KOVoYdOD5mBP+nTYK6De88MTqm3kSDPnN6+fNlNv1dLz6tGyV30mmS1Ub0S4SrC/
 fKQJlj41EL+T/cK304KgQ3u0PpqS7lxSr8/3II5tIii0ED5uXN/t66IuZ4ztCA4p
 6F6WK4DNsxRs5HFGnVaoZjB45KiH6LqDzLqZb+OBVpETGSK4gRzXiHsVVqPUFZAr
 IkPDTrhE9jyGUr54HWFCCVL05K/yMoUlcFGiohxgpZNA2Vmzi0GvoVZBHcqZs1Bg
 EEG114QzqEjLLpvBaJidlBMJafrUB11prlUpkkjjceqJlakWlCDWfBsi3T9rRA27
 R7eBQ0XqDOMoMcFCKHkJVajkPK/rqFMz5LU9+AyXOXkGYO8VI6+6u8ylJY3CjZeB
 ziR5CE9Ly7WDO08CO3UlrVWvNQzh7BUQK/yoP+cRWUbPEP/NV6Jz2yfK5CDMlCDl
 4UYyxYnjaqUFx74TpFB2GtcA61Sqvy2EAATe6UL4uQcGrT16lDqiAJA0kYGChzjc
 4KvQBPen8ESb4n/zjfNdXOtCNxPm7JIFNjXPFuw62+w7qGKtDwDZUcr6FF3cZYVL
 oeUThOj4dwpsl3Pbd56nJYBHsiPyvgrm4Fk5Gv4+f2biIHZCas0=
 =MzJz
 -----END PGP SIGNATURE-----

Merge tag 'gpio-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio updates from Bartosz Golaszewski:
 "There's one new driver, one legacy driver removed, a kunit test-suite
  for the GPIO core, support for new models in existing drivers and a
  slew of various changes in many places though I can't think of
  anything controversial that would stand out - it's been a relatively
  calm cycle.

  GPIO core:
   - Add an initial set of kunit test cases for the GPIO subsystem
   - Use the devres owner as the GPIO chip's parent in absence of any
     other parent
   - Fix const-correctness of GPIO chip SRCU guards
   - Provide new GPIO consumer interfaces: gpiod_is_single_ended() and
     fwnode_gpiod_get()
   - Quarantine all legacy GPIO APIs in linux/gpio/legacy.h
   - Use __ro_after_init where applicable

  New drivers:
   - Add driver for the GPIO controller on Waveshare DSI TOUCH panels

  Removed drivers:
   - Remove the obsolete ts5500 GPIO driver

  Driver updates:
   - Modernize gpio-timberdale: remove platform data support and use
     generic device property accessors
   - Extend test build coverage by enabling COMPILE_TEST for more GPIO
     drivers
   - Add some missing dependencies in Kconfig
   - Add support for sparse fixed direction to gpio-regmap
   - Remove dead code from gpio-nomadik
   - use BIT() in gpio-mxc
   - use bitmap_complement() in gpio-xilinx and gpio-pca953x
   - Use more appropriate printing functions where applicable
   - Use named initializers for platform_device_id and i2c_device_id
     arrays
   - Convert gpio-altera to using the generic GPIO chip helper library
   - Add support for new models to gpio-dwapb, gpio-zynq, gpio-usbio and
     gpio-tegra186
   - Unify the naming convention for Qualcomm in GPIO drivers
   - Fix interrupt bank mapping to GPIO chips in gpio-mt7621
   - Add support for the lines-initial-states property to gpio-74x164
   - Switch to using dynamic GPIO base in gpio-ixp4xx
   - Move the handling of an OF quirk from ASoC to gpiolib-of.c where
     other such quirks live
   - Use handle_bad_irq() in gpio-ep93xx
   - Some other minor tweaks and refactorings

  Devicetree bindings:
   - Document the Waveshare GPIO controller for DSI TOUCH panels
   - Document new models: Tegra238 in gpio-tegra186 and EIO GPIO in
     gpio-zynq
   - Add new properties for gpio-dwapb and fairchild,74hc595
   - Fix whitespace issues
   - Sort compatibles alphabetically in gpio-zynq

  Documentation:
   - Fix kerneldoc warnings in gpio-realtek-otto

  Misc:
   - Attach software nodes representing GPIO chips to the actual struct
     device objects associated with them in some legacy platforms
     enabling real firmware node lookup instead of string matching
   - Drop unneeded dependencies on OF_GPIO from bus and staging drivers"

* tag 'gpio-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (62 commits)
  gpio: nomadik: remove dead DB8540 code from <gpio/gpio-nomadik.h>
  gpio: mt7621: fix interrupt banks mapping on gpio chips
  bus: ts-nbus: drop unneeded dependency on OF_GPIO
  staging: media: max96712: drop unneeded dependency on OF_GPIO
  gpiolib: Replace strcpy() with memcpy()
  gpio: remove obsolete UAF FIXMEs from lookup paths
  gpio: core: fix const-correctness of gpio_chip_guard
  gpio: mxc: use BIT() macro
  gpio: realtek-otto: fix kernel-doc warnings
  gpio: max77620: Unify usage of space and comma in platform_device_id array
  gpio: Use named initializers for platform_device_id arrays
  gpio: cros-ec: Drop unused assignment of platform_device_id driver data
  ARM: omap1: enable real software node lookup of GPIOs on Nokia 770
  ARM: omap1: use platform_device_register_full() for GPIO devices on OMAP 16xx
  ARM: omap1: drop unused variable from omap16xx_gpio_init()
  gpio: gpiolib: use seq_puts() for plain strings
  gpio: ts5500: remove obsolete driver
  gpio: add kunit test cases for the GPIO subsystem
  kunit: provide kunit_platform_device_unregister()
  kunit: provide kunit_platform_device_register_full()
  ...
2026-06-16 07:30:52 +05:30
Jakub Kicinski
dad4d4b92a Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Cross-merge networking fixes after downstream PR (net-7.1-rc8).

Conflicts:

drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c
  f67aead16e ("net: txgbe: rework service event handling")
  57d39faed4 ("net: txgbe: improve functions of AML 40G devices")

net/rds/info.c
  512db8267b ("rds: mark snapshot pages dirty in rds_info_getsockopt()")
  6e94eeb2a2 ("rds: convert to getsockopt_iter")

Adjacent changes:

include/net/sock.h
  1ee90b77b7 ("net: guard timestamp cmsgs to real error queue skbs")
  f0de88303d ("net: make is_skb_wmem() available to modules")

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11 14:33:35 -07:00
Daniel Drake
a23226b7c1 gpiolib: handle gpio-hogs only once
Commit d1d564ec49 ("gpio: move hogs into GPIO core") introduced a
behaviour change that breaks boot on Raspberry Pi 5 when using the
firmware-supplied device tree:

  gpiochip_add_data_with_key: GPIOs 544..575
    (/soc@107c000000/gpio@7d517c00) failed to register, -22
  brcmstb-gpio 107d517c00.gpio: Could not add gpiochip for bank 1
  brcmstb-gpio 107d517c00.gpio: probe with driver brcmstb-gpio failed
    with error -22

gpio-brcmstb registers two gpio_chips against the device tree
node gpio@7d517c00, one for each bank. The firmware-supplied DT includes
a gpio-hog on RP1 RUN, and this gpio-hog is attempted to be applied to
*both* gpio_chips. This succeeds against bank 0 (which hosts the GPIO)
and fails for bank 1 (which does not).

In the previous implementation, failures to apply gpio-hogs were
quietly ignored. In the new code, the error code propagates and causes
probe to fail.

Closely approximate the previous behaviour by using the OF_POPULATED flag
to ensure that each gpio-hog is processed only once. The flag was
previously being set before the gpio-hogs were processed, so as part
of this change, the flag now gets set only after the gpio-hog is actioned.
The handling of gpio-hogs on a DT node with multiple gpio_chips remains a
bit incomplete/unclear, but this at least retains the ability to apply
hogs to the first gpio_chip per node.

Fixes: d1d564ec49 ("gpio: move hogs into GPIO core")
Signed-off-by: Daniel Drake <dan@reactivated.net>
Link: https://patch.msgid.link/20260608210108.36248-1-dan@reactivated.net
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-10 10:12:57 +02:00
Bartosz Golaszewski
64911f5aac gpio: fix cleanup path on hog failure
If gpiochip_hog_lines() successfully processes some hogs but fails on
a later one, the error handling path in gpiochip_add_data_with_key()
jumps directly to err_remove_of_chip. This leaks resources allocated
earlier for ACPI, interrupts and hogs that were successfully processed.
Use the right label in error path.

Closes: https://sashiko.dev/#/patchset/20260608210108.36248-1-dan%40reactivated.net
Fixes: d1d564ec49 ("gpio: move hogs into GPIO core")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Link: https://patch.msgid.link/20260609-gpio-hogs-fixes-v1-2-b4064f8070e7@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-10 09:29:19 +02:00
Nuno Sá
55c01d3794 gpio: gpio-ltc4283: Add support for the LTC4283 Swap Controller
The LTC4283 device has up to 8 pins that can be configured as GPIOs.

Note that PGIO pins are not set as GPIOs by default so if they are
configured to be used as GPIOs we need to make sure to initialize them
to a sane default. They are set as inputs by default.

Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20260502-ltc4283-support-v13-3-1c206542e652@analog.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-09 08:30:29 -07:00
Sergio Paracuellos
a46f2e5720 gpio: mt7621: fix interrupt banks mapping on gpio chips
The GPIO controller's registers are organized as sets of eight 32-bit
registers with each set controlling a bank of up to 32 pins. A single
interrupt is shared for all of the banks handled by the controller.
The driver implements this using three gpio chip instances every one
with its own irq chip. Every single pin can generate interrupts having
a total of 96 possible interrupts here. It looks like there is a problem
with interrupts being properly mapped to the gpio bank using this solution.
This problem report is in the following lore's link [0].

Device tree is using two cells for this, so only the interrupt pin and the
interrupt type are described there. Changing to have three cells to setup
also the bank and implement 'of_node_instance_match()' would also work but
this would be an ABI breakage and also a bit incoherent since gpios itself
are also using two cells and properly mapped in desired bank using through
its pin number on 'of_xlate()'.

That said, register a linear IRQ domain of the total of 96 interrupts shared
with the three gpio chip instances so the bank and the interrupt is properly
decoded and devices using gpio IRQs properly work.

[0]: https://lore.kernel.org/linux-gpio/CAAMcf8C_A9dJ_v4QRKtb9eGNOpJ7BZNOGsFP4i2WFOZxOVBPnQ@mail.gmail.com/T/#u

Fixes: 4ba9c3afda ("gpio: mt7621: Add a driver for MT7621")
Co-developed-by: Vicente Bergas <vicencb@gmail.com>
Signed-off-by: Vicente Bergas <vicencb@gmail.com>
Tested-by: Vicente Bergas <vicencb@gmail.com>
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Link: https://patch.msgid.link/20260609031118.2275735-1-sergio.paracuellos@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-09 13:36:22 +02:00
Marco Scardovi
1c1e0fc88d gpio: rockchip: fix generic IRQ chip leak on remove
The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove/teardown, the generic chips are not automatically freed when the
IRQ domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic IRQ chip suspend,
resume, or shutdown callbacks after the GPIO bank has been removed,
potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by explicitly calling
irq_domain_remove_generic_chips() before removing the IRQ domain in
rockchip_gpio_remove().

Fixes: 936ee2675e ("gpio/rockchip: add driver for rockchip gpio")
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Marco Scardovi <scardracs@disroot.org>
Link: https://patch.msgid.link/20260607230504.35392-2-scardracs@disroot.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-09 13:24:20 +02:00
Samuel Moelius
446e8c31d0 gpio: mockup: reject invalid gpio_mockup_ranges widths
gpio-mockup validates only that each second gpio_mockup_ranges value is
non-negative before creating the mock chips.  The fixed-base form uses
the second value as the first GPIO number after the range, while the
dynamic-base form uses it as the number of GPIOs.

gpio_mockup_register_chip() stores the resulting number of GPIOs in a
u16 and passes it through a PROPERTY_ENTRY_U16("nr-gpios", ...).  Values
greater than U16_MAX therefore truncate silently.  For example,
gpio_mockup_ranges=-1,65537 creates a one-line mock GPIO chip instead of
rejecting the invalid request.

Reject zero-width, reversed, and over-U16 ranges before registering any
mock chip.

Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Link: https://patch.msgid.link/20260609004538.1240091.3fba33a20b88.gpio-mockup-ngpio-u16-truncation@trailofbits.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-09 13:19:56 +02:00
Ruoyu Wang
6edb934de9 gpio: zynq: fix runtime PM leak on remove
pm_runtime_get_sync() increments the runtime PM usage counter even when it
returns an error. zynq_gpio_remove() uses it to keep the controller active
while removing the GPIO chip, but never drops the usage counter again.

Balance the get with pm_runtime_put_noidle() after disabling runtime PM.

Fixes: 3242ba117e ("gpio: Add driver for Zynq GPIO controller")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Link: https://patch.msgid.link/20260609073313.5-1-ruoyuw560@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-09 13:19:13 +02:00
Yun Zhou
b9ad50d750 gpio: mvebu: fix NULL pointer dereference in suspend/resume
mvebu_pwm_suspend() and mvebu_pwm_resume() are called for all GPIO
banks during suspend/resume, but not all banks have PWM functionality.
GPIO banks without PWM have mvchip->mvpwm set to NULL.

Calling mvebu_pwm_suspend() with mvpwm == NULL causes a NULL pointer
dereference when it tries to access mvpwm->blink_select.

  Unable to handle kernel NULL pointer dereference at virtual address 00000020 when write
  [00000020] *pgd=00000000
  Internal error: Oops: 815 [#1] PREEMPT ARM
  Modules linked in:
  CPU: 0 UID: 0 PID: 406 Comm: sh Not tainted 6.12.74-rt12-yocto-standard-g4e96f98fb7db-dirty #353
  Hardware name: Marvell Armada 370/XP (Device Tree)
  PC is at regmap_mmio_read+0x38/0x54
  LR is at regmap_mmio_read+0x38/0x54
  pc : [<c05fd2ac>]    lr : [<c05fd2ac>]    psr: 200f0013
  sp : f0c11d10  ip : 00000000  fp : c100d2f0
  r10: c14fb854  r9 : 00000000  r8 : 00000000
  r7 : c1799c00  r6 : 00000020  r5 : 00000020  r4 : c179c7c0
  r3 : f0a231a0  r2 : 00000020  r1 : 00000020  r0 : 00000000
  Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
  Control: 10c5387d  Table: 135ec059  DAC: 00000051
  Call trace:
   regmap_mmio_read from _regmap_bus_reg_read+0x78/0xac
   _regmap_bus_reg_read from _regmap_read+0x60/0x154
   _regmap_read from regmap_read+0x3c/0x60
   regmap_read from mvebu_gpio_suspend+0xa4/0x14c
   mvebu_gpio_suspend from dpm_run_callback+0x54/0x180
   dpm_run_callback from device_suspend+0x124/0x630
   device_suspend from dpm_suspend+0x124/0x270
   dpm_suspend from dpm_suspend_start+0x64/0x6c
   dpm_suspend_start from suspend_devices_and_enter+0x140/0x8e8
   suspend_devices_and_enter from pm_suspend+0x2fc/0x308
   pm_suspend from state_store+0x6c/0xc8
   state_store from kernfs_fop_write_iter+0x10c/0x1f8
   kernfs_fop_write_iter from vfs_write+0x270/0x468
   vfs_write from ksys_write+0x70/0xf0
   ksys_write from ret_fast_syscall+0x0/0x54

Add a NULL check for mvchip->mvpwm before calling the PWM
suspend/resume functions.

Fixes: 757642f9a5 ("gpio: mvebu: Add limited PWM support")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Link: https://patch.msgid.link/20260608084334.2960803-1-yun.zhou@windriver.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-08 16:34:30 +02:00
David Laight
25afa211ae gpiolib: Replace strcpy() with memcpy()
The length of the string is calculated in order to allocate the correct
sized memory block, use the same length to copy the string.

Signed-off-by: David Laight <david.laight.linux@gmail.com>
Link: https://patch.msgid.link/20260606202633.5018-3-david.laight.linux@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-08 10:15:11 +02:00
Marco Scardovi (scardracs)
07c44ee9fd gpio: remove obsolete UAF FIXMEs from lookup paths
The ACPI and swnode GPIO lookup backends both temporarily grab a reference
to the gpio_device, resolve the descriptor, and then drop the reference
before returning the descriptor to the caller. They carry FIXME comments
warning that the descriptor is being returned without its backing device
reference.

However, the gpiod_find_and_request() core functionally prevents any
use-after-free window by wrapping the entire lookup operation inside the
gpio_devices_srcu read lock. The lookup functions are correct to drop
their references since the caller (gpiod_request) will subsequently take
its own permanent module and device references safely.

Remove these obsolete FIXMEs to prevent misleading future subsystem
developers.

Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Marco Scardovi <scardracs@disroot.org>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260524162708.62949-3-scardracs@disroot.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-04 15:51:31 +02:00
Marco Scardovi (scardracs)
aa7e8b7ef0 gpio: core: fix const-correctness of gpio_chip_guard
The DEFINE_CLASS macro for gpio_chip_guard currently expects a non-const
struct gpio_desc pointer. This prevents the guard from being used cleanly
in fast paths that receive a const descriptor, forcing developers to fall
back to open-coding the SRCU locks.

Update the macro to accept a const struct gpio_desc pointer. This is valid
because the actual targeted gpio_device pointer assignment does not drop
const qualifiers on the target structure.

Convert the open-coded SRCU locks in gpiod_get_raw_value_commit() and
gpiod_to_irq() to use the guard, removing their legacy FIXME comments.

Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Marco Scardovi <scardracs@disroot.org>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260524162708.62949-2-scardracs@disroot.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-04 15:51:31 +02:00
Jakub Kicinski
d44646fc9e Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Cross-merge networking fixes after downstream PR (net-7.1-rc6).

Conflicts:

drivers/net/phy/air_en8811h.c
  d895767c33 ("net: phy: air_en8811h: add AN8811HB MCU assert/deassert support")
  dddfadd751 ("net: phy: Add Airoha phy library for shared code")
  5226bb6634 ("net: phy: air_phy_lib: Factorize BuckPBus register accessors")
  e08f0ea6da ("net: phy: Rename Airoha common BuckPBus register accessors")

net/sched/sch_netem.c
  a2f6ed7b48 ("net/sched: netem: add per-impairment extended statistics")
  9552b11e3e ("net/sched: fix packet loop on netem when duplicate is on")

Adjacent changes:

drivers/dpll/zl3073x/core.c
  c1224569ce ("dpll: zl3073x: make frequency monitor a per-device attribute")
  54e65df8cf ("dpll: zl3073x: report FFO as DPLL vs input reference offset")

net/iucv/af_iucv.c
  347fdd4df8 ("af_iucv: convert to getsockopt_iter")
  3589d20a66 ("net/iucv: fix locking in .getsockopt")

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-28 14:02:21 -07:00
Marco Scardovi
9500077678 gpio: rockchip: teardown bugs and resource leaks
Address several teardown issues and resource leaks in the driver's remove
path and error handling:

1. Debounce clock reference leak: The debounce clock (bank->db_clk) is
   obtained using of_clk_get() which increments the clock's reference
   count, but clk_put() is never called. Register a devm action to
   cleanly release it on unbind. Note that of_clk_get(..., 1) remains
   necessary over devm_clk_get() because the DT binding does not define
   clock-names, precluding name-based lookup.

2. Unregistered chained IRQ handler: The chained IRQ handler is not
   disconnected in remove(). If a stray interrupt fires after the driver
   is removed, the kernel attempts to execute a stale handler, leading
   to a panic. Fix this by clearing the handler in remove().

3. IRQ domain leak: The linear IRQ domain and its generic chips are
   allocated manually during probe but never removed. Remove the IRQ
   domain during driver teardown to free the associated generic chips
   and mappings.

Fixes: 936ee2675e ("gpio/rockchip: add driver for rockchip gpio")
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Marco Scardovi <scardracs@disroot.org>
Link: https://patch.msgid.link/20260526171050.12785-3-scardracs@disroot.org
[Bartosz: don't emit an error message on devres allocation failure]
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-28 15:23:40 +02:00
Marco Scardovi
3e46c18d5d gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
The bank->clk was previously obtained via of_clk_get() and manually
prepared/enabled. However, it was missing a corresponding clk_put() in
both the error paths and the remove function, leading to a reference leak.

Convert the allocation to devm_clk_get_enabled(), which also properly
propagates failures from clk_prepare_enable() that were previously ignored.

The GPIO bank device uses the same OF node as the previous of_clk_get()
call, so devm_clk_get_enabled(dev, NULL) correctly resolves the same
clock provider entry.

Fix the reference leak and simplify the code by removing the manual
clk_disable_unprepare() calls in the probe error paths and in the
remove function.

Fixes: 936ee2675e ("gpio/rockchip: add driver for rockchip gpio")
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Marco Scardovi <scardracs@disroot.org>
Link: https://patch.msgid.link/20260526171050.12785-2-scardracs@disroot.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-28 15:23:40 +02:00
Dan Carpenter
8a122b5e72 gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write()
If *ppos is non-zero (user-space write split over multiple calls to
write()) then simple_write_to_buffer() won't initialize the start of the
buffer. Really, non-zero values for *ppos aren't going to work at all.
Check for that and return -EINVAL at the start of the function.

Fixes: 91581c4b3f ("gpio: virtuser: new virtual testing driver for the GPIO API")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/ahP3BJWWy-m_qI0X@stanley.mountain
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-28 15:23:40 +02:00
Bartosz Golaszewski
9d7697fabb gpio: shared: fix lockdep false positive by removing unneeded lock
By the time gpio_device_teardown_shared() is called, the parent device
is gone from the global list of GPIO devices and all outstanding SRCU
read-side critical sections have completed. That means that no
concurrent gpio_find_and_request() can call
gpio_shared_add_proxy_lookup() for this device at this time. There's
also no risk of the parent device being re-bound to the driver before
the unbinding completes (including the child devices).

Lockdep produces a false-positive report about a possible circular
dependency as it doesn't know the ordering guarantee. Not taking the
ref->lock in gpio_device_teardown_shared() silences it and is safe to do.

Cc: stable@vger.kernel.org
Fixes: ea513dd3c0 ("gpio: shared: make locking more fine-grained")
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260522-gpio-shared-deadlock-v1-2-76bca088f8c0@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-28 15:23:40 +02:00
Bartosz Golaszewski
a1b8366073 gpio: shared: fix deadlock on shared proxy's parent removal
Commit 710abda580 ("gpio: shared: call gpio_chip::of_xlate() if set")
used the mutex embedded in struct gpio_shared_entry to protect the
offset field which now can be modified after assignment. The critical
section however is too wide and introduced a potential deadlock on the
removal of the shared GPIO proxy's parent.

Make the critical section shorter - only protect the offset when it's
being read.

While at it: mention the fact that the entry lock is now also used to
protect against concurrent access to the offset field in the structure's
documentation.

Cc: stable@vger.kernel.org
Fixes: 710abda580 ("gpio: shared: call gpio_chip::of_xlate() if set")
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260522-gpio-shared-deadlock-v1-1-76bca088f8c0@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-28 15:23:39 +02:00
Bartosz Golaszewski
a5c627d908 gpio: adnp: fix flow control regression caused by scoped_guard()
scoped_guard() is implemented as a for loop. Using it to protect code
using the continue statement changes the flow as we now only break out
of the hidden loop inside scoped_guard(), not the original for loop. Use
a regular code block instead.

Fixes: c7fe19ed39 ("gpio: adnp: use lock guards for the I2C lock")
Reported-by: David Lechner <dlechner@baylibre.com>
Closes: https://lore.kernel.org/all/cde2abb2-4cc8-4fc9-b34a-0c5d2b95779f@baylibre.com/
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260522073527.9812-1-bartosz.golaszewski@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-28 15:23:39 +02:00
Bartosz Golaszewski
bbec30f7e1 gpio: shared: undo the vote of the proxy on GPIO free
When the user of a shared GPIO managed by gpio-shared-proxy calls
gpiod_put() to release it, we never undo the potential "vote" for
driving the shared line "high". In the free() callback, check if this
proxy voted for "high" and - if so - decrease the number of votes and
potentially revert the value to low if this is the last user.

Cc: stable@vger.kernel.org
Fixes: e992d54c6f ("gpio: shared-proxy: implement the shared GPIO proxy driver")
Closes: https://sashiko.dev/#/patchset/20260513-gpio-shared-dynamic-voting-v1-1-8e1c49961b7d%40oss.qualcomm.com
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260522-gpio-shared-free-vote-v3-1-8a4fddc6bedb@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-28 15:23:39 +02:00